Internals

• Storage Engine Chronix uses a Log-Structured Merge-tree (LSM-tree) architecture adapted for time-series workloads. This design separates the fast write path from the optimised read path, achieving high ingestion….
• Write-Ahead Log (WAL) The Write-Ahead Log provides crash-safe durability for the Chronix write path. Every mutation is persisted to the WAL before being applied to the memtable, guaranteeing that acknowledged writes….
• Memtable & Skip Lists The memtable is the in-memory write buffer that sits between the WAL and on-disk segment files. It must support high-concurrency writes with ordered iteration (for flushing sorted columnar segments).
• Columnar Segments Chronix stores flushed data in immutable columnar segment files (.csx). The columnar format is fundamental to analytical query performance — it enables compression, vectorised processing, and….
• Compaction Strategies Compaction is the background process that merges overlapping segment files, reclaims space from deleted data, and bounds read amplification.
• Indexing Chronix uses multiple indexing structures to minimise the amount of data read from disk during query execution. Together they form a multi-level pruning pipeline that can eliminate >99% of….
• Caching Chronix uses three complementary caches to minimise disk I/O and reduce query latency.
• Column Encoding Time-series data has strong statistical regularities that general-purpose compressors (LZ4, zstd) cannot fully exploit. Chronix uses type-specific encoders that understand the structure of….
• Delta-of-Delta Timestamp Encoding Time-series timestamps are monotonically increasing and typically arrive at regular intervals (e.g. every 10 seconds). Delta encoding stores the difference δᵢ = tᵢ − tᵢ₋₁ instead of the raw value,….
• ALP, Gorilla, Chimp & Patas Float Compression IEEE 754 double-precision floating-point numbers occupy 64 bits with a complex internal structure.
• Integer & ZigZag Encoding Integer columns in time-series data (counters, sequence numbers, byte counts) are often monotonically increasing. Delta encoding stores differences.
• Dictionary & Bitmap Encoding String columns in time-series data are almost always low-cardinality — tag values like 'us-east', 'us-west', 'production', 'staging'. A measurement with millions of rows might have only 5–50….
• Adaptive Encoding Selection A time-series database ingests many different columns with wildly different data characteristics. The optimal encoding varies per type and per workload.
• Forecasting Time-series forecasting predicts future values from observed history. In an operational context — infrastructure monitoring, capacity planning, SLA management — forecasts drive automated….
• Exponential Smoothing Exponential smoothing methods produce forecasts as weighted averages of past observations, where the weights decay exponentially. They are the most widely used forecasting family for operational….
• ARIMA & SARIMA ARIMA models capture autocorrelation — the dependency of a value on its own past values — through a combination of three components.
• Model Selection Choosing the right forecasting model is as important as tuning it. This page describes the automated selection strategy used by Chronix when the user does not explicitly specify a model.
• Prediction Intervals A point forecast is incomplete without an estimate of its uncertainty. Prediction intervals quantify the range within which future observations are expected to fall with a given probability.
• Anomaly Detection Anomaly detection identifies observations that deviate significantly from expected behavior. In time-series monitoring, anomalies signal potential incidents — hardware failures, misconfigurations,….
• Z-Score & MAD Detectors The Z-score measures how many standard deviations a point lies from the mean.
• IQR (Interquartile Range) Detector The interquartile range method is a non-parametric anomaly detector that makes no assumptions about the data distribution. It is based on the box-plot methodology introduced by Tukey (1977).
• Residual-Based Anomaly Detection Instead of applying statistical tests to raw values, the residual method first removes expected structure (trend, seasonality) using a forecast model, then applies anomaly detection to the residuals.
• Dynamic Thresholds Traditional monitoring uses static thresholds: 'alert if CPU > 90%'. This fails for metrics with.
• CUSUM Change-Point Detection Cumulative Sum (CUSUM) control charts detect persistent shifts in the mean of a process. Unlike point anomaly detectors (Z-Score, IQR) that flag individual outliers, CUSUM accumulates small….
• Multivariate Analysis Real systems produce many correlated time-series simultaneously — CPU, memory, disk I/O, network throughput, request latency. Analyzing each series independently misses cross-variable….
• Correlation Analysis Correlation measures the strength and direction of the relationship between two variables. For time-series monitoring, correlation analysis answers questions like: 'When CPU goes up, does latency….
• Mahalanobis Distance Euclidean distance treats all dimensions equally and ignores correlations. For multivariate anomaly detection, this produces misleading results.
• Isolation Forest Most anomaly detection methods build a model of normal data and then flag points that deviate from it. Isolation Forest flips this: it directly isolates anomalies by exploiting their two key….
• Principal Component Analysis (PCA) A system producing metrics generates observations in a 50-dimensional space. Visualizing, understanding, and detecting anomalies in 50D is intractable. But the metrics are often highly correlated….
• Vector Autoregression (VAR) ARIMA models forecast each series independently. But in systems monitoring, metrics are causally linked — a disk I/O spike causes latency to increase, which causes queue depth to grow. VAR models….
• Preprocessing Time-series data arriving from real-world systems is rarely clean. Sensors fail, networks drop packets, clocks drift, and sampling intervals vary. Preprocessing transforms raw data into a form….
• Query Execution Chronix implements a SQL-compatible query engine optimized for time-series workloads. The engine translates SQL statements into a physical plan of streaming operators that process columnar data….
• Streaming & Change Data Capture Batch queries answer 'what happened?' Streaming answers 'what is happening right now?' For infrastructure monitoring, near-real-time processing is essential — an alert that arrives 5 minutes late….
• Signal Processing & Triggers Signal triggers are continuous monitoring rules that evaluate conditions against live time-series data and fire alerts when thresholds are breached. They bridge the gap between passive data….
• Model Lifecycle Management Analytical models (forecasters, anomaly detectors) are not static — they must be trained, versioned, retrained as data evolves, and eventually retired. Without lifecycle management, stale models….
• Compute Engine & SIMD Time-series analytics involves repetitive numerical operations over large arrays — summing millions of floats, comparing timestamps, filtering by tag values. Modern CPUs provide SIMD (Single….
• Distributed Systems Chronix operates as a distributed cluster for production deployments, providing horizontal scalability, fault tolerance, and high availability.
• Raft Consensus In a distributed system, nodes must agree on a shared state (cluster membership, shard assignments, leadership) despite crashes and network partitions. Raft (Ongaro & Ousterhout, 2014) solves this….
• Consistent Hashing Simple modular hashing () fails when the number of nodes changes — all keys are reassigned.
• Security Internals How Chronix authenticates and authorises: Argon2 API keys, JWT/OIDC with fail-closed algorithm selection, mTLS, Cedar policies, and encryption at rest.
• Deterministic Simulation Testing Chronix includes a deterministic simulation testing framework (chronix-dsim) inspired by FoundationDB's simulation testing and Jepsen. This enables rigorous verification of.