Traces
Trace Error Origin
Updated Jul 28, 2026 · 1d ago
Walks the span graph to find the origin service of an error cascade — where the failure started, not the services that merely reported it.
Example alert
Exact wording varies — the detector generates titles from the anomaly it finds. This is representative of what an alert looks like when it fires.
How it works
Reads error spans and walks the parent/child span graph: an error span whose children aren't also erroring is an origin. So in auth → gateway → frontend all returning 500, it fingers auth, not the frontend that surfaced it. Fires per origin service over an absolute error-span threshold — no learning period.
Availability
Runs on these tiers:
Want to see this detector firing in the live demo?
Open alerts in the sandbox →Related detectors
- Trace Latency Break
Catches a service whose request latency regressed against its own past — the whole distribution shifted slower.
- Trace Tail Shift
Catches partial degradation: most requests are fine but a slice falls off a cliff — the tail blows up while the median holds.
- Trace Throughput Drop
Catches a service whose request volume collapsed — crashed, deadlocked, or off the load balancer — when no slow or error spans give it away.
- Trace New Operation
Flags a service serving an operation it never served before — an unannounced deploy, a new endpoint, or a client calling a new path.