> For the complete documentation index, see [llms.txt](https://docs.catalyx.solutions/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/grafana-dashboards.md).

# Grafana Dashboards

The CatalyX UI does not embed dashboards. Instead it links out to your Grafana instance, pre-filtered to the component you were looking at — so you land on the right data rather than a blank dashboard

## Where the links are

<table><thead><tr><th width="290">Location</th><th>Links</th></tr></thead><tbody><tr><td><a href="/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/validators-list.md">Validators list</a></td><td><strong>Metrics</strong> and <strong>Logs</strong> columns, per validator, targeting its participant.</td></tr><tr><td><a href="/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/validators/summary.md">Validator → Summary</a></td><td>Per component row: metrics for the participant, logs for every component.</td></tr><tr><td><a href="/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/applications.md">Applications list</a></td><td><strong>Metrics</strong> and <strong>Logs</strong> columns per application.</td></tr><tr><td><a href="/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/validators.md">Application details</a></td><td><strong>Open in Grafana</strong> links in the <strong>Endpoints</strong> section.</td></tr></tbody></table>

All of them open in a new tab, so you keep your place in the UI.

## What each link opens

**Logs** opens Grafana's Loki log explorer, filtered to the component's service name, over the **last 24 hours**, newest first.

**Metrics** opens the Canton participant dashboard, filtered to that participant, over the **last hour**, refreshing every five minutes.

{% hint style="info" %}
**Metrics links only appear for participant components.** The participant is the component with a Canton-specific dashboard; other components expose standard Kubernetes workload metrics, which you can reach through your own dashboards. Logs are available for every component.
{% endhint %}

## Configuration

Set at install time, in the Helm values:

<table><thead><tr><th width="260">Value</th><th>Purpose</th></tr></thead><tbody><tr><td><code>ui.grafana.baseUrl</code></td><td>Base URL of your Grafana instance.</td></tr><tr><td><code>ui.grafana.dataSource</code></td><td>Optional. The UID of the Loki data source to query, when Grafana has more than one.</td></tr></tbody></table>

{% hint style="warning" %}
**The Grafana buttons are always rendered**, whether or not `ui.grafana.baseUrl` points at a reachable Grafana. If you have not configured it, the links will open a broken page rather than being hidden. Set `ui.grafana.baseUrl` as part of every install.
{% endhint %}

## Prerequisites

For these links to resolve to real data you need:

* **Grafana**, reachable by the people using the UI.
* **Loki**, receiving logs from the cluster, for the log links.
* **Prometheus**, scraping validator component metrics, for the metrics links. Enable `monitoring.serviceMonitor.enabled` in the Helm values if you use the Prometheus Operator.
* **The Canton participant dashboard** installed in your Grafana. Contact IntellectEU support for the dashboard definition.

{% hint style="info" %}
The resource figures shown *inside* the UI — the CPU and memory bars on the lists and detail pages — do not come from Prometheus. They come from the Kubernetes metrics API, which requires `metrics-server` in the cluster. Prometheus and Grafana are only needed for the deep links.
{% endhint %}

## Access and permissions

Grafana access is customer-specific and is provisioned by the IntellectEU team — you should not need direct access to the Kubernetes cluster or the Grafana infrastructure itself. Authentication goes through Keycloak SSO; once your account is provisioned, the links above resolve to the dashboards assigned to your environment. Access to Grafana is separate from access to the CatalyX UI — having one does not automatically grant the other.

### How do I access Grafana?

Your Grafana dashboard URL is provided by the IntellectEU team as part of your environment setup.

1. Open the provided Grafana URL in your browser.
2. If your environment uses SSO, you'll be redirected to the configured identity provider — typically Keycloak — to authenticate.
3. After successful authentication, you should be able to access the Grafana dashboards assigned to your account.

{% hint style="info" %}
Grafana access is separate from access to the CatalyX UI or the underlying AWS/Kubernetes infrastructure. Having access to one does not necessarily grant access to the others.
{% endhint %}

### Why do I see "Forbidden" or "Access denied"?

If the Grafana URL opens but you receive a **403 Forbidden**, Grafana itself is reachable — your authenticated account just doesn't have permission to access the requested resource. Common causes include:

* Your user hasn't been provisioned for Grafana yet.
* Your Grafana user is authenticated through the wrong Keycloak realm/account.
* Your user hasn't been assigned to the required Grafana organization.
* The dashboard hasn't been shared with your user.
* Your account has insufficient permissions for the requested dashboard.
* You're using a dashboard URL that belongs to another customer/environment.
* The Grafana/Keycloak configuration changed recently and your permissions haven't been synchronized yet.

Grafana is authenticated through Keycloak SSO, and each customer is scoped to only their own dashboards — one customer cannot view another's.

### What should I do if Grafana says "Forbidden"?

1. Make sure you're using the Grafana URL provided for your environment.
2. Log out and log back in using the correct customer account.
3. If login succeeds but you still get **403 Forbidden**, contact CatalyX support.
4. When you contact support, provide:
   * the Grafana URL;
   * the username/email you're using;
   * the environment (DevNet/MainNet/etc.);
   * a screenshot of the error;
   * roughly when the issue occurred.

Support can then verify whether your user is correctly provisioned and has the required Grafana organization/dashboard permissions.

### I can log in to Grafana, but I cannot see my dashboard. What should I do?

This is usually a permissions or dashboard-configuration issue rather than an authentication problem. Contact CatalyX support with the Grafana URL, your username/email, the environment, and a screenshot — support can then verify your Grafana organization, permissions, and dashboard access.

### I cannot log in to Grafana at all. What should I check?

If you can't reach the Grafana login page, the issue may be with the Grafana service, ingress, or DNS. If the login page loads but authentication itself fails, it's more likely an issue with your Keycloak account or the configured SSO integration. Either way, contact CatalyX support with a screenshot of the error and the Grafana URL you're using.

### Can I use the same credentials as the CatalyX UI?

Not necessarily. Grafana and the CatalyX UI may share the same identity provider (such as Keycloak), but access to Grafana dashboards is controlled separately through Grafana's own permissions. Having access to CatalyX doesn't automatically grant access to every Grafana dashboard.

{% hint style="warning" %}
Do not use shared or default credentials (such as `admin`/`admin`) for Grafana access. Current deployments authenticate through Keycloak/SSO with customer-specific permissions.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/user-guide-canton/grafana-dashboards.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.