Frequently asked questions

#What is TraceHound?

Cloud Certainty TraceHound is a better Amazon CloudWatch Logs console, and it runs entirely in your own AWS account. It shows what every log group stores, ingests and costs, with a growth history and recommendations for log groups that never expire, are orphaned, stale or noisy, and changes their retention in bulk. Your teams search and explore logs with a histogram, facets, patterns and charts, follow one request id across every service with Trace, share one Live Tail session instead of paying for one each, and keep versioned, shared queries and dashboards. Administrators grant users and groups access per log group pattern, AWS enforces every grant, and a history of who ran which query and what it cost, plus an audit log, record what happened. You install it with one CloudFormation stack, and no data leaves your account.

#Pricing

#How much does it cost?

TraceHound is sold on AWS Marketplace with contract pricing: pay monthly, or for 12 months up front.

Prices are in US dollars and billed through your AWS bill. Plans are not priced per user or per GB: everyone in your organisation can use TraceHound.

#Why do Business and Enterprise appear as add-ons?

On the TraceHound listing, Team is the base plan and Business and Enterprise are add-ons to it. For Business, choose Team and the Business add-on; for Enterprise, choose all three. A plan counts only when every plan below it on the listing is in the contract too, so an add-on bought on its own grants nothing. Starter is a separate listing, TraceHound Starter.

#What else do I pay for?

CloudWatch itself, and the AWS resources the stack uses in your account, are billed to you by AWS as usual. TraceHound is serverless, so it costs close to nothing while nobody is using it.

Every query shows its bytes scanned and estimated cost, and administrators see the totals per day under Administration › Usage (per user and per Region on Business and above).

#What happens when the contract ends?

TraceHound keeps working on the last plan for up to 72 hours, then every page says a licence is required and only the licence page works for administrators. All data (saved queries, dashboards, history, storage history, the audit log) stays in your account, and subscribing again unlocks it. The same 72 hours cover a brief outage of AWS License Manager. The collector keeps recording storage history in the meantime.

#Plans

#What does each plan include?

• Every plan has the Overview, the log group inventory with storage and ingestion history, cost estimates and recommendations, Explore with search, histogram, facets, patterns and charts, Trace, shared Live Tail, private saved queries and dashboards with templates and versions, the query history with cost, connections to other accounts, grants, daily usage, the audit log, and IAM Identity Center and Cognito sign-in with MFA.
• Team adds retention changes from TraceHound (one log group or hundreds at once), shared saved queries and dashboards, snapshots, and SAML and OIDC identity providers.
• Business adds the IP allowlist, daily scan budgets per user, and usage and cost per user and per Region.
• Enterprise has the Business features with the highest limits and five years of storage history.

#How are AWS accounts counted?

Each distinct AWS account among your connections counts once, the hub account included. A connection can cover every Region of its account at no extra count. When all are in use, new accounts can't be connected; accounts already connected keep working.

#Deployment

#Which AWS Regions are supported?

Any Region with Amazon CloudWatch Logs, AWS Lambda (with function URLs and response streaming), Amazon API Gateway, Amazon DynamoDB, Amplify Hosting, Amazon Cognito, AWS License Manager, Amazon EventBridge and Amazon ECS on Fargate, for example us-east-1, eu-west-1, eu-west-2, eu-central-1 and ap-southeast-2. The same template URL works in every Region. The Region you deploy to doesn't limit which Regions you can read: the stack's LocalRegions parameter and each connection list the Regions to show.

#How do I install it?

Subscribe on AWS Marketplace and launch one CloudFormation stack in the account that subscribed. Creation takes about 10 minutes. See Getting started and the installation guide.

#Does anything run in my VPC?

Only a one-off installer task, for about a minute at install and at each upgrade. It needs outbound HTTPS. Nothing accepts inbound connections, and the rest of the stack is serverless.

#Does it work with many AWS accounts?

Yes. Deploy the spoke role template once in each account, or across an AWS Organization with a StackSet. TraceHound assumes that role with an external ID, and the role's access level (Read or Manage) and optional log group prefixes are the upper limit of what it can do there. See Deploy the spoke role in other accounts.

#Why is there no storage history before I installed TraceHound?

CloudWatch reports a log group's stored bytes only as a value for now, and keeps no history of it. TraceHound's collector records it once a day from the day you install it. Ingestion is different: CloudWatch keeps it as metrics, so the first run reads 90 days back.

#Which identity providers work?

Amazon Cognito users (with required MFA) and AWS IAM Identity Center on every plan. Other SAML 2.0 providers, such as Microsoft Entra ID and Okta, and OIDC providers on Team and above. See Identity providers.

#Data and security

#Does any data leave my account?

No. Your logs stay in CloudWatch Logs, query results stay in Logs Insights, and everything TraceHound stores (connections, grants, saved queries, dashboards, snapshots, query and storage history, the log group cache and the audit log) is in DynamoDB in your account. Cloud Certainty runs no service in the data path, and TraceHound sends no telemetry. The licence check is a read from AWS License Manager in your own account. The only outbound request to us is the optional daily read of a public release manifest, which sends nothing about you; set UpdateChecks to Disabled to turn it off. See the security overview.

#Can users only see what they are granted?

Yes. Users see no log groups until an administrator grants them access, by log group name pattern, per account and Region. Each request runs with short-lived AWS credentials that a session policy limits to the user's grants, so AWS itself refuses a query, search or live tail on a log group the user may not read. See Permissions.

#Does TraceHound unmask data protected by a data protection policy?

No. TraceHound's roles never have logs:Unmask, so masked data stays masked for everyone, administrators included.

#Can one user see another user's results?

Not through TraceHound. Results are shown only to the person who ran the query and to administrators, and TraceHound's result reuse returns only your own earlier runs. The one exception is a snapshot (Team and above), which its creator deliberately shares with everyone signed in, after a warning.

#Who ran which query?

TraceHound's query history records who ran every query and what it scanned and cost, and administrators can see everyone's day by day. In CloudTrail, every CloudWatch Logs call TraceHound makes carries the user's email as its sourceIdentity, and the role session is named th-<email>.

#Can TraceHound change my log groups?

Only their retention, and only if you let it. The default access level, Read, changes nothing. Retention changes need a connection with the Manage access level, the Team plan or above, and a grant with the manage permission on those log groups, and each one is recorded in the audit log with the old and new values. TraceHound never deletes log groups or events, and never changes their class, encryption, filters or policies.

#How does it compare?

#Why not the CloudWatch console?

AWS has made the console good at search: facets, surrounding logs, patterns, natural language queries and the Log Analytics view. TraceHound doesn't replace it for administering CloudWatch, but it covers what teams still miss:

#Why not ship the logs to a SaaS log platform?

A SaaS platform such as Datadog or Grafana Cloud charges for the logs you send it, again, on top of CloudWatch, and your logs leave AWS. TraceHound works on the logs where they already are, in your account, at a flat price per team.

#Does TraceHound make my CloudWatch bill smaller?

It helps in several ways:

• Retention. Most stored bytes come from log groups that never expire. TraceHound finds them, orphaned and stale log groups too, and sets a retention in bulk with the saving shown first.
• Noisy log groups. Ingestion is usually most of the bill; TraceHound shows who ingests the most and how it grows.
• Infrequent Access candidates. Busy log groups without metric filters, which could use the cheaper class when they are created next.
• Shared Live Tail. One session per set of log groups instead of one per viewer.
• Per-user reuse. Running the same query again, or opening a dashboard again, within the reuse age (5 minutes by default) shows your earlier result without scanning.
• Free reads. The Events tab and context use free CloudWatch Logs reads instead of Logs Insights.
• Scan budgets (Business and above). A daily limit of bytes scanned per person.

#Can it search more than 50 log groups at once?

Logs Insights reads at most 50 log groups per query, and Explore follows that limit. Trace has no limit: it searches any number of log groups in batches of 50 and merges the results. Log group name patterns such as /aws/lambda/orders-* pick the matching log groups for you.

#Does it work with Infrequent Access log groups?

Yes, with CloudWatch's own limits: Logs Insights queries work, but CloudWatch doesn't allow live tail, FilterLogEvents (the Events tab), surrounding events or the pattern and diff commands on them, so TraceHound turns those off for them. Delivery class log groups appear in the inventory, but Logs Insights can't query them.

#Upgrades

#How do I install a new release?

Each release is a new template. Update the stack with the new template URL and keep your parameter values. Administrators see a banner when a new release is out. See the upgrading guide and the release notes.

#How do I change plan?

Email [email protected]: we prepare an AWS Marketplace offer that credits the rest of your current contract. Between Team, Business and Enterprise no stack update is needed: the new limits and features apply when the new contract is active, and TraceHound keeps working on your current plan for up to 72 hours while the agreement changes. Your saved queries, dashboards, history and settings stay as they are. See Changing plan.

#Support

#How do I get help?

Basic support is included: email [email protected] with your stack's Region, the release you run (the ProductVersion stack output) and what you see. We respond within one business day. Paid support plans with response times are on the support page.

#Does Cloud Certainty have access to my account?

No. We have no access to your account and TraceHound doesn't give us any. When you ask for help, you share what you choose, such as an error message or a query id.