Features
What the ProxTrace console does, module by module.
Each module reads the same collector observations. The views below reproduce the console screens using sample data.
01 · Events
Every Proxmox task, categorized and backed by evidence.
Tasks, API calls, logins and logs become events linked to the relevant node, VM or container. The subject (creation, backup…) and the outcome (success, failure) remain separate pieces of information.
- Change qmconfig
- Lifecycle qmstart
- Migration qmigrate
- Backup vzdump
- Snapshot qmsnapshot
- Storage qmmove
- Access vncproxy
- Security firewall
- System node
- Error incident
- Other —
- Simple view : relevant operations and recognized incidents, with correlated steps grouped together and explained.
- Advanced view : every observation, including technical logs.
- Filters : node, resource or VMID, account or token, source IP, operation, time range; reflected in the URL.
- Evidence : before/after values and raw observation in a panel beside the table.
- Attribution : a login is linked to an account only when there is a unique match, and is then marked “Correlated”.
- Request and change merged : an API request and the configuration change it produces form a single event, even when the request goes through a node other than the VM’s. The change is dated to the second the configuration was written and shows up less than a minute after the request.
- Timeline : an event opened from the overview, a notification or a proof is shown in place in the list, with what surrounds it, in both the Simple and Advanced views.
02 · Inventory
Know which machine each change belongs to.
Nodes, QEMU VMs, LXC containers, storage and networks, with their last known state. Each resource retains its history and opens its details in a side panel.
| Machine | Node | State | Guest agent | Latest backup |
|---|---|---|---|---|
| qemu:104 - erp-db | pve-02 | Running | Enabled, responding | Succeeded |
| qemu:112 - gitlab | pve-03 | Running | Enabled, responding | Succeeded |
| qemu:118 - win-rds | pve-03 | Stopped | Cannot be verified | None observed |
| lxc:201 - dns-int | pve-02 | Running | — | Failed |
- QEMU guest agent : enabled in Proxmox, a verified response in the OS, and IP addresses per interface — three separate pieces of information.
- Readable identifiers :
type:identifiant - Nom, for exampleqemu:104 - erp-db. - Search : Ctrl K opens the palette of pages, machines and actions.
03 · Security & compliance
Proxmox security audit: 115 checks.
Each check is divided into stable criteria. Each criterion presents its observation, exact values grouped by node, a suggested action, its sources and the limits of its evidence.
Read the Proxmox security audit guideAreas covered
- Inventory
- Quorum and Corosync
- pmxcfs
- Clocks
- Versions and repositories
- Critical services
- SSH
- Accounts, roles and API tokens
- root@pam
- Multifactor authentication
- Certificates
- Firewall
- Bridges and bonds
- Migration
- HA and fencing
- Storage, ZFS, Ceph
- Replication
- Backups and retention
- Snapshots
- Recovery
- VM configuration
- LXC containers
- SDN
- Proxmox Backup Server
- Authentication failures
- Four statuses : Pass, Fail, Not assessable, Out of scope; missing data never counts as a pass.
- Recalculation runs automatically every five minutes, across all organizations.
- Sealed reports : the state on a given date remains available exactly as it was assessed.
- Frameworks : NIS2 (article 21.2), ISO 27001 (annex A) and the CIS Controls, requirement by requirement, with CSV export.
- Proven backups : latest backup, size, verification and encryption read from the storages; restores compared with the RTO.
- Export the audit from the console.
04 · Attention
A priority queue, with evidence for every item.
Relevant incidents are grouped by category: backups, operations, storage, Proxmox access and Proxmox versions. An item can be taken in hand or deferred, and returns if the problem recurs.
| Severity | Item | Resource | Follow-up |
|---|---|---|---|
| High | Backup failed, 2 occurrences | lxc:201 - dns-int | Attention |
| Medium | pbs-01 storage at 91% | storage:pbs-01 | In progress |
| Low | No backup observed | qemu:118 - win-rds | Deferred |
05 · Coverage
What ProxTrace knows, and what it does not.
Proxmox and collector availability, event delivery and source freshness for each host. A check that depends on a delayed source is never shown as passing.
| Host | API | SSH reader | Logs |
|---|---|---|---|
| pve-01 | Up to date | Up to date | Up to date |
| pve-02 | Up to date | Up to date | Up to date |
| pve-03 | Up to date | Delayed | Up to date |
06 · Organizations and roles
Several clients or sites in one console, each within its own scope.
Restrictions are enforced on the server for lists, details, exports, notifications, compliance and assistant conversations. A new non-admin account cannot see any organization until one is assigned.
| Role | Scope | Can |
|---|---|---|
| Administrator | All organizations | Manage accounts, settings, collectors, checks and priorities. |
| Operator | Assigned organizations | Manage collectors, checks and priorities. |
| Auditor | Assigned organizations | View inventory, events and checks; use the assistant. |
- Console audit : account actions in ProxTrace are logged.
07 · Notifications
Get notified about the changes that matter.
Each account chooses its categories, then within each one the kinds of change to receive: the firewall without the CPU, only failed starts… Exceptions by organization, node or machine refine further, right from a notification: no more firewall changes for a single VM, a node silenced during its maintenance. Each account keeps its own read status. The company’s working days, hours and time zone define what counts as “outside business hours”.
- Machine changes
- Lifecycle
- Migrations
- Creations and deletions
- Backup failures
- Snapshot failures
- Cluster and node firewall
- Accounts, roles and ACL
- Logins outside business hours
- Collector contact lost
08 · AI assistant
Answers that cite their sources.
Optional and activated only on demand, with the provider and model you configure. It only reads the account’s scope and changes nothing in Proxmox.
Why is check 14.1 failing?
The latest backup vzdump of lxc:201 - dns-int failed on 8 October at 13:58, and this is the second occurrence. The other guests have a successful backup within the period.
14.1-02 vzdump · 13:58:20
- Limited context : from a criterion, “Ask the assistant” works on that specific point and its sealed report.
- Citations : each reference opens the exact event or criterion.
- No AI requests when simply browsing the screens.
09 · Collection
A read-only collector, installed on your nodes.
L’installation part de la console : une commande exécutée sur un nœud installe l’agent, prépare le lecteur restreint sur tous les nœuds du cluster et déploie les agents en veille. Une installation existante se reconfigure avec la même organisation.
- Hosts : restricted account
proxtrace-readerwith a forced command, sudo limited to the reader, and verified SSH host keys. No root. - API : minimal permissions detected according to the Proxmox VE version.
- VM inspection through the guest agent: Disabled, Basic or Extended.
- Local queue : batch delivery, removal after acknowledgment, and log catch-up in a separate process.
- Updates to the collector are tracked from the console.
10 · Limitations
What ProxTrace does not do.
- Administer Proxmox VE
- Proxmox VE remains your administration tool. ProxTrace never performs automatic actions on nodes or machines.
- Monitor metrics in real time
- Continuous CPU, memory and network tracking remains the role of your monitoring tools.
- Certify infrastructure
- Checks assess best practices and retain evidence; they are not a certification.
- Track VMware or Hyper-V
- ProxTrace is designed exclusively for Proxmox VE.