Find PII, risky patterns, and inefficient requests in AI traffic.
Eve analyzes gateway traffic so teams can see what AI is touching, where sensitive data appears, and which requests are driving cost or risk.
Three-tier capture architecture
Hot-path counters capture broad request signals while sampled cold-path analysis adds deeper context.
Hot Path
Every request updates atomic counters with minimal hot-path work.
Command counts, latency, bytes, hot keys
Force Sampling
Errors, slow queries, and dangerous commands always captured.
Bounded at 10K events per window
Burst Capture
Full traffic sampling triggered by anomaly detection.
Statistically representative via reservoir sampling
Request intelligence from the gateway path
Eve analyzes traffic where it is already being governed. Enable gateway analytics and connect request-level signals to policy, identity, cost, and performance.
Anti-Pattern Detection
Eve watches your traffic at two levels: per-connection sequences and per-endpoint aggregates. Hot key detection via Space-Saving sketch (64-entry, O(1) lookup). Key pattern extraction with LRU cache (10k entries).
PII Detection
Real-time regex-based scanning for sensitive data in keys and values. Detects emails, credit card numbers, SSNs, phone numbers, and API keys with automatic redaction before storage.
30+ Rule Recommendation Engine
Not dashboards to stare at. Actionable recommendations with severity levels, confidence scores, and estimated monthly cost savings. Covers write-heavy patterns, oversized values, hot keys, large hash operations, and read replica candidates.
Gateway-Level Analysis
Analytics sits in the gateway layer. No agents to deploy, no SDKs to integrate, no code changes in the calling app.
Detected Anti-Patterns
Automatically flagged with confidence scores and actionable recommendations.
N+1 Queries
5 repeated commands
Hot Keys
> 15% traffic
KEYS Command
Any occurrence
Unbounded Range
Any occurrence
Large Responses
> 64 KB
High Fanout
100+ keys in MGET/MSET
High Error Rate
> 10% rate
Missing TTLs
> 80% no TTL
Slow Queries
> 10ms
Dangerous Commands
FLUSHDB, SHUTDOWN, CONFIG
Large Hash Ops
> 5 KB per operation
Write-Heavy Never-Read
0 reads on pattern
Live Recommendations for Running Systems
Eve turns gateway traffic into recommendations with severity, confidence, and actionable improvements.
Write-Heavy, Never-Read Pattern
Pattern: session:*:temp
Writing 12,400/day with 0 reads. Consider removing or adding a TTL.
N+1 Query Detected
Endpoint: /api/v1/orders
42 sequential identical queries per request. Batch into a single query to reduce latency by ~85%.
Read Replica Candidate
Endpoint: analytics-db-primary
92% read ratio across 340K daily requests. Route reads to a replica to reduce primary load.
Anomaly Detection & Observability
Three-stage anomaly detection with adaptive metadata collection. Full OpenTelemetry integration for distributed tracing and metrics export.
Jensen-Shannon Divergence
Compares real-time command distribution against baseline. Watch state at 2% divergence, critical at 5%.
3-window confirmation before alerting
5-window cooldown before reset
5-minute confirmation memory bridging gaps
Adaptive Metadata Polling
Three-frequency collection that accelerates up to 8x during anomalies with hysteresis to prevent flapping.
High: 60s · Medium: 30min · Low: 24h
Normal → Watch → Elevated → Critical
ClickHouse storage with 60s flush cycles
OpenTelemetry Integration
Full OTel support with distributed context propagation, structured logging, and OTLP metric export.
Health snapshots every 60s per endpoint
ops/sec, p50/p99/p999 latency, error rate
Datadog integration out of the box
See what AI traffic is telling you.
Enable Eve analytics and connect request patterns to risk, cost, and operational context.