Running scans

A scan is one full pass over your telemetry that produces the recommendations you see on the Optimize Logs and Optimize Metrics pages. You rarely need to think about scans (they run automatically), but you can trigger one whenever you want.

Automatic (nightly) scans

By default Obics runs a scan every night. It:

1. Reads the latest logs and metrics from your observability provider.
2. Runs both the logs and metrics pipelines.
3. Refreshes the recommendations, moving new noise into the Active tab and re-ranking everything by cost.

You can turn the nightly scan on or off, and tune its scope (how many services and log groups it covers), under Settings → Scan (see Settings).

Running a scan on demand

From either the Optimize Logs or Optimize Metrics page, open the ⋮ (more actions) menu in the top bar:

• Queue logs scan: re-run the logs pipeline (a Refresh cache variant re-reads everything from the vendor instead of using cached data).
• Queue metrics scan: re-run the metrics pipeline.
• Queue full scan: run both.
• Recent scans: see past scans with their status (Queued / Running / finished), environment, and how many items were found or optimizable.

If an organization has never been scanned, the page shows a Queue Metrics Scan (or equivalent) button in place of the grid.

What a scan produces

Each scan writes a fresh set of recommendations:

Pipeline	Result page	Unit	Ranked by
Logs	Optimize Logs	Log groups (clusters of near-identical lines)	Monthly cost
Metrics	Optimize Metrics	Individual metrics	Cardinality / monthly cost

While a scan is in progress the page shows “A scan is currently in progress…” and auto-refreshes until it completes.

What happens during a scan

For the curious, here’s the sequence behind each pipeline:

• Logs: cluster the log lines → match each cluster to the source line that emits it → ask an LLM for an optimization per cluster.
• Metrics: discover every metric and its cardinality (and which dashboards and monitors use it) → find where each metric is emitted in code → ask an LLM which metrics are redundant or reducible.

The full service-by-service breakdown is in the Architecture reference.