On this page
Connect an account and follow the collection#
Hyvop knows nothing about your cloud until an administrator connects an account. This page covers what happens after that: what is collected, when, and how to read the two cards that tell you where it stands.
Connect an account#
Data Sources > Cloud Providers (/integrations?tab=scan). Only an administrator can connect an account. Each cloud has
its own steps and its own permissions, written for the person who sets it up in the administrator guide:
AWS, Azure, GCP.
The Community Edition connects one cloud account. A second one is refused while the first is on, and the refusal names the one that is connected. Switching the first off is always allowed.
What is collected#
As soon as the account is connected, Hyvop collects four things, then keeps them up to date on a schedule.
| Collection | What it is | How often (as shipped) |
|---|---|---|
| Inventory | The resources of the account: instances, volumes, buckets, databases and the rest | Every 4 hours |
| Metrics | Usage figures for those resources, such as CPU, network, connections and requests | Every 2 hours |
| Billing | What the account was billed, read from its cost report | Nightly at 02:00 |
| Resources for ownership | A copy of the inventory into the ownership screens, with each resource's cost of the last full month | Every 15 minutes |
Prices are read from the cloud's public price lists, weekly. An administrator can change the schedules; the values are in the configuration reference.
Billing is collected only when the connection says where the cost data is: the cost report bucket on AWS, the cost export on Azure, the billing export table on GCP. Without it Hyvop still lists resources and finds waste, and shows no cost.
Two limits of the Community Edition show up here. A scan reads at most 1,000 resources, counted across every service and region; when it stops there, a notice above every screen says that what you see is part of the account. Metrics are kept for 30 days. editions.md has the whole table.
The "Getting started" checklist#
A new install has nothing to show, so the first screens show a checklist instead. It goes away when all four steps are done.
| Step | What it says | What to do |
|---|---|---|
| Connect a cloud account | "One account on AWS, Azure or GCP" while there is none, then the account that is connected | Connect one (an administrator) |
| First collection | Being read, failed with the reason, or done with the time. A failure says "It is tried again by itself" | Wait for a running one. For a failed one, read the reason, and see the Ingestion card |
| Detectors | "No detector is installed yet", "Every installed detector is switched off", or how many are on | Install some from Detection > Marketplace, or switch one on in Detection > Installed |
| First detection run | Detection runs after each collection and every night; then how many detectors have run and how many failed | An administrator can start it from Detection > Installed ("Run detection now") |
If core cannot be asked, the checklist says so ("The state of the collections could not be read from core") and does not guess. A failed load is not "no findings".
The "Ingestion" card#
On the cloud providers page (/integrations), the card named Ingestion shows, for the connected account, one line for
each collection: Inventory, Metrics, Billing and Resources for ownership.
What a line can say:
| The line says | It means |
|---|---|
running now |
The collection has started and is not finished |
last run <time>, with N rows |
The last run finished. For the ownership copy it also says how many resources have a cost and for which month |
last failed <time>, with a reason below |
The last run failed. Hyvop tries again by itself, and the line says how many times it did |
not run yet |
Nothing has run for this collection |
next <time> |
When the next run is due |
Under a line you may also see:
- A service that failed inside a run that otherwise went through, as
<service>: <reason>. - Items the scan could not read, as
Left out: <service> in <region>: <reason>. n regions are not enabled for this account and were not scanned. This is not a failure: an AWS account does not have every region switched on, and Hyvop reads the ones that are.
If the card says "The ingestor cannot be reached from core right now; scheduled collections will fail until it is", the problem is in the install, not in your account. Tell the administrator; troubleshooting has the checks.
Why a new install finds little#
- A detector that looks at usage waits until a resource has enough history: 7 days for some, 28 for others (findings.md says which).
- The rules "stopped for 7 days" and "unattached for 7 days" count from the day Hyvop first saw the resource in that state. On the first day nothing is that old yet.
- A resource that is gone from the cloud leaves the inventory, so detectors stop reporting it.
Demo data#
An install can be run on demo data. It is written under the reserved account hyvop-demo, never under a real account,
and an administrator sees a notice on the AWS page with how many rows there are and a button that removes them all.