Start an investigation

Every entry point opens the same investigation card, with the same words and the same answers. Start in one place and answer in another.

Write a good first message

Name the app and the symptom, and say when it started if you know. Nova uses them to find the app and pick the causes worth testing.

Vague	Better
"Something is broken."	"checkout returns 5xx errors since about 14:00."
"Check my cluster."	"Pods for billing-worker are stuck in Pending on the prod cluster."
"Why is it slow?"	"orders has been slow since the last deploy."
"Fix the app."	"payments-api keeps restarting. What is wrong?"

A question about cost, planning or how to do something is answered in chat, not as an investigation.

From a console conversation

1. Open Nova and start a conversation.
2. Describe the problem, for example "Why is checkout returning 5xx errors?".
3. The investigation opens as a card in the conversation. It also appears under Investigations in the sidebar, where what needs you is listed first.

From an app page

1. In the console, open Applications and choose the app.
2. Choose Ask Nova on the page. Nova already knows which app you are looking at.
3. Describe the problem, for example "Why is this app not serving?".

From the terminal

1. Run astroctl nova.
2. Ask the same question you would ask in the console, for example "payments-api keeps restarting. What is wrong?".
3. To pick up a conversation later, run astroctl nova --continue for the most recent one, or astroctl nova --resume-id <id> for a specific one.
4. Follow and answer the investigation from the same chat: its card updates in place, and Ctrl+A on an empty prompt opens its answers. Type /investigations to list your investigations by status, and press Enter on one to open its card.

See Nova Terminal and the CLI reference.

From Slack

Slack is on the Enterprise plan.

1. Connect the Slack skill under Skills in Nova, and invite Nova to the channel.
2. In a thread, mention Nova and describe the problem, for example "@nova checkout is returning 5xx errors".
3. Once Nova has read the first facts, the thread gets the investigation's card, edited in place as it works. Answer what it asks with the card's buttons, or reply in the thread.

Nova acts in Slack as the person who asks, with their own AstroPulse role. It matches your Slack account to your AstroPulse account by email, so each person needs an AstroPulse account in the organization with the same email as their Slack profile, and must have signed in to AstroPulse and opened the organization at least once. Otherwise Nova replies that it could not match your account, or that your account is not connected yet, and does nothing.

Automatically, when an alert fires

Alertmanager or Grafana can start an investigation as soon as an alert fires. Each one is a deep investigation and uses its units. On the Enterprise plan, the result can also post to a Slack channel. Organization owners and admins set this up.

1. In Nova, open Settings (the gear at the bottom of the sidebar) and choose Incidents.
2. Optionally, under Post results to Slack channel, enter a channel such as #incidents. Slack must be connected, and Nova must be a member of the channel.
3. Choose Create alert token and copy it. It is shown once, with a ready-made Alertmanager receiver.
4. Point your alerting at Nova.

Alertmanager. Add a receiver with your token:

YAML

receivers:
  - name: nova
    webhook_configs:
      - url: https://astropulse.io/api/alerts/alertmanager
        send_resolved: false
        http_config:
          authorization:
            credentials: <your alert token>

Grafana. Add a webhook contact point with the same URL, and send the token as the header Authorization: Bearer <your alert token>.

Any other system. POST an Alertmanager (version 4) payload to the same URL with the same header.

When an alert fires, Nova posts in the channel that it is investigating, updates that message as it works, and replies in the thread when its state changes. Alerts in the same group join one investigation. Investigations started by an alert or from Slack are shared with your organization, so whoever is on call can open and answer them.

For a test alert, grouping, hourly limits, token rotation and what to do when Slack does not get the result, see Alerts.

Over the API

Alerts are the API's way to start an investigation. To find, follow and answer investigations over the API, see Over the API.

Next

• During an investigation: what you can do while Nova works.