# What are Events and how are they monitored?

**Events** are discrete interactions between two participants in an AI system (usually an agentic system) that involve an input, processing, and an output.

### Overview

Event monitoring captures and analyzes interactions in your AI ecosystem, from simple chat completions to sophisticated multi-agent workflows. Each Event represents a communication between different participants in your AI system and provides detailed insights into the flow, security, and compliance of your AI operations.

{% stepper %}
{% step %}

### Event Participants

Events are categorized by the participants involved in the interaction:

| Participant        | Description                                        |
| ------------------ | -------------------------------------------------- |
| **User**           | The end user initiating requests and interactions  |
| **LLM**            | Large language models processing requests          |
| **Agent**          | Autonomous agents in agentic frameworks            |
| **Tool**           | External tools, APIs, or plugins agents can access |
| **Memory**         | Memory storage systems for agent state             |
| **Initialization** | Agent initialization (future feature)              |
| {% endstep %}      |                                                    |

{% step %}

### Event Types

Events are classified based on participant relationships.

#### Basic Events

* **user\_llm**: Standard user-to-LLM interactions (chat completions, Q\&A)
* **user\_agent**: User requesting an agentic system to perform tasks

#### Agent Events

* **agent\_llm**: Agent communicating with LLMs for various purposes
* **agent\_tool**: Agent invoking external tools or APIs
* **agent\_agent**: Agent-to-agent communication
* **agent\_mem**: Agent accessing memory storage
* **agent\_init**: Agent initialization and configuration

#### Agent-LLM Event Subtypes

* **agent\_llm.planning**: Agent requesting workflow planning from LLM
* **agent\_llm.action**: Agent asking LLM how to execute specific actions
* **agent\_llm.content**: Agent requesting content creation from LLM

#### Tool Integration Events

* **agent\_tool.mcp**: Agent using Model Context Protocol (MCP)
* **agent\_tool.api**: Direct API tool invocations
* **agent\_tool.data\_source**: Agent accessing non-MCP data sources

#### Agent Communication Events

* **agent\_agent.a2a**: Agent-to-Agent protocol communication
* **agent\_agent.custom\_channel**: Custom communication channels
  {% endstep %}

{% step %}

### Event Properties

Each event includes comprehensive metadata and analysis results.

#### Core Identifiers

* **event\_id**: Unique ULID identifier (lexicographically sortable)
* **event\_type**: Classification based on participants
* **session\_id**: Groups related events in a session
* **profile\_id**: Associated Aiceberg monitoring profile

#### Content

* **input**: The original request or message
* **output**: The response from the receiving participant
* **user\_id**: Identifier for the initiating user or application

#### Analysis Results

* **input\_signal\_result**: Security and compliance analysis of inputs
* **output\_signal\_result**: Analysis of outputs
* **event\_result**: Overall event assessment
* **input\_system\_actions**: Automated actions taken on inputs
* **output\_system\_actions**: Automated actions taken on outputs
  {% endstep %}

{% step %}

### Event Status

Events progress through various states:

| Status                          | Description                          |
| ------------------------------- | ------------------------------------ |
| `created`                       | Event logged and queued for analysis |
| `running`                       | Analysis in progress                 |
| `running.input_analysis`        | Analyzing input content              |
| `running.fetching_llm_response` | Waiting for LLM response             |
| `running.output_analysis`       | Analyzing output content             |
| `finished.input_blocked`        | Input blocked by policies            |
| `finished.output_blocked`       | Output blocked by policies           |
| `success`                       | Event completed successfully         |
| `success.input_modified`        | Input was modified before processing |
| `success.output_modified`       | Output was modified before delivery  |
| `failed`                        | Event processing failed              |
| {% endstep %}                   |                                      |
| {% endstepper %}                |                                      |

***

## Event Monitoring

### Viewing Single Events

Events appear in the Monitoring interface and Prompt Details.

To view Events in Monitoring, navigate to the appropriate tab and tap the filter icon.

![](/files/e5e1c049aab7cf7a9ff4e7353e278b51293db07b)

Tap the gear icon and enable the Event To and Event From columns.

![](/files/f4fff96473d1a0367321880f57ba69bdef6328a3)

Event icons are now visible. Filtering and sorting on Event type, status, or participant will be included in a future release. Hovering over an Event icon will show the participant type.

![](/files/6e59aa15721883ab2bc205915e835168a377eeb1)

In Prompt Details, Event participant icons are located near the Prompt and Response text.

![](/files/03196380dfcbce90ce88c4c5103e752e7a9e725b)

### Viewing Events as Part of an Agentic Workflow

Single events can be seen in context by enabling the Sessions view in Monitoring. For complex agentic systems, event monitoring provides:

#### Planning Visibility

Track how agents break down complex requests:

```
user_agent: "Create a quarterly report"
└── agent_llm.planning: Agent requests execution plan
    └── agent_tool.data_source: Agent retrieves Q3 data
        └── agent_llm.content: Agent generates report sections
```

#### Tool Usage Tracking

Monitor agent tool interactions:

* API calls and responses
* Data source queries
* MCP protocol communications
* Custom tool integrations

#### Agent Communication

Observe multi-agent coordination:

* Task delegation between agents
* Information sharing
* Collaborative problem-solving

### Best Practices

#### Event Organization

* Implement session management for related interactions
* Leverage event subtypes for granular analysis

### Security Monitoring

* Regularly review failed events for security indicators
* Monitor agent tool usage for unauthorized access attempts
* Track input/output modifications for compliance auditing

### Performance Optimization

* Filter events by time range for large-scale analysis
* Use event\_type filtering to focus on specific workflows
* Monitor processing times for performance insights


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.aiceberg.ai/monitoring/what-is-the-monitoring-page/what-are-events-and-how-are-they-monitored.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.