What are Events and how are they monitored?
Events are discrete interactions between two participants in an AI system (usually an agentic system) that involve an input, processing, and an output.
Overview
Event monitoring captures and analyzes interactions in your AI ecosystem, from simple chat completions to sophisticated multi-agent workflows. Each Event represents a communication between different participants in your AI system and provides detailed insights into the flow, security, and compliance of your AI operations.
Event Participants
Events are categorized by the participants involved in the interaction:
User
The end user initiating requests and interactions
LLM
Large language models processing requests
Agent
Autonomous agents in agentic frameworks
Tool
External tools, APIs, or plugins agents can access
Memory
Memory storage systems for agent state
Initialization
Agent initialization (future feature)
Event Types
Events are classified based on participant relationships.
Basic Events
user_llm: Standard user-to-LLM interactions (chat completions, Q&A)
user_agent: User requesting an agentic system to perform tasks
Agent Events
agent_llm: Agent communicating with LLMs for various purposes
agent_tool: Agent invoking external tools or APIs
agent_agent: Agent-to-agent communication
agent_mem: Agent accessing memory storage
agent_init: Agent initialization and configuration
Agent-LLM Event Subtypes
agent_llm.planning: Agent requesting workflow planning from LLM
agent_llm.action: Agent asking LLM how to execute specific actions
agent_llm.content: Agent requesting content creation from LLM
Tool Integration Events
agent_tool.mcp: Agent using Model Context Protocol (MCP)
agent_tool.api: Direct API tool invocations
agent_tool.data_source: Agent accessing non-MCP data sources
Agent Communication Events
agent_agent.a2a: Agent-to-Agent protocol communication
agent_agent.custom_channel: Custom communication channels
Event Properties
Each event includes comprehensive metadata and analysis results.
Core Identifiers
event_id: Unique ULID identifier (lexicographically sortable)
event_type: Classification based on participants
session_id: Groups related events in a session
profile_id: Associated Aiceberg monitoring profile
Content
input: The original request or message
output: The response from the receiving participant
user_id: Identifier for the initiating user or application
Analysis Results
input_signal_result: Security and compliance analysis of inputs
output_signal_result: Analysis of outputs
event_result: Overall event assessment
input_system_actions: Automated actions taken on inputs
output_system_actions: Automated actions taken on outputs
Event Status
Events progress through various states:
created
Event logged and queued for analysis
running
Analysis in progress
running.input_analysis
Analyzing input content
running.fetching_llm_response
Waiting for LLM response
running.output_analysis
Analyzing output content
finished.input_blocked
Input blocked by policies
finished.output_blocked
Output blocked by policies
success
Event completed successfully
success.input_modified
Input was modified before processing
success.output_modified
Output was modified before delivery
failed
Event processing failed
Event Monitoring
Viewing Single Events
Events appear in the Monitoring interface and Prompt Details.
To view Events in Monitoring, navigate to the appropriate tab and tap the filter icon.
Tap the gear icon and enable the Event To and Event From columns.
Event icons are now visible. Filtering and sorting on Event type, status, or participant will be included in a future release. Hovering over an Event icon will show the participant type.
In Prompt Details, Event participant icons are located near the Prompt and Response text.
Viewing Events as Part of an Agentic Workflow
Single events can be seen in context by enabling the Sessions view in Monitoring. For complex agentic systems, event monitoring provides:
Planning Visibility
Track how agents break down complex requests:
user_agent: "Create a quarterly report"
└── agent_llm.planning: Agent requests execution plan
└── agent_tool.data_source: Agent retrieves Q3 data
└── agent_llm.content: Agent generates report sectionsTool Usage Tracking
Monitor agent tool interactions:
API calls and responses
Data source queries
MCP protocol communications
Custom tool integrations
Agent Communication
Observe multi-agent coordination:
Task delegation between agents
Information sharing
Collaborative problem-solving
Best Practices
Event Organization
Implement session management for related interactions
Leverage event subtypes for granular analysis
Security Monitoring
Regularly review failed events for security indicators
Monitor agent tool usage for unauthorized access attempts
Track input/output modifications for compliance auditing
Performance Optimization
Filter events by time range for large-scale analysis
Use event_type filtering to focus on specific workflows
Monitor processing times for performance insights
Last updated