Join our Newsletter — 33% off our NHI Course
Home› Glossary› Cyber Security› Active Series
Cyber Security

Active Series

← Back to Glossary
By NHI Mgmt Group Updated November 4, 2026 Domain: Cyber Security

Active series are the time series currently held in Prometheus memory and actively tracked for scraping, querying, and storage. They matter because head-block memory scales with the number of active series, not just with how much raw data a service emits.

What Active Series Means in Prometheus

Active series are the label combinations Prometheus is currently tracking in memory for scrape ingestion, query evaluation, and storage. The practical point is that memory pressure comes from how many series remain active, not just from how much total metric data a system emits.

Why Active Series Drive Memory and Cost

In Prometheus, each active series carries metadata and indexing overhead, so a workload with many unique label combinations can consume far more head-block memory than a smaller, repetitive metric set. This is why cardinality, especially labels that explode into thousands or millions of distinct values, is often the real scaling constraint.

High active-series counts can also increase CPU load during scraping and querying because Prometheus has to manage more time series objects, more samples, and more index lookups. In practice, the same application can look “small” by bytes ingested but still be expensive because of its series shape.

How Active Series Are Created and Kept Alive

An active series exists when Prometheus has recently seen that label set and continues to retain it across scrapes and query activity. Series can come and go as targets appear, metric names change, or label values stop being emitted, but the in-memory population is what matters for immediate resource use.

Operationally, the key distinction is between raw sample volume and series churn. A service can emit modest sample counts while still generating a large number of active series if it uses highly variable labels such as per-request IDs, user IDs, or ephemeral host identifiers.

What to Watch for in Metric Design

Active series are usually a symptom of metric design, not a Prometheus quirk. The most common drivers are unbounded label values, unnecessary per-entity labels, and instrumentation that turns business identifiers into metric dimensions.

The best way to reason about them is to ask whether a label helps answer a stable operational question. If the label only makes each sample unique, it tends to increase series count without improving observability, and that trade-off becomes painful as traffic grows.

How to Reduce Active Series Pressure

Keeping active series under control usually means trimming label cardinality, simplifying metric schemas, and reviewing which dimensions truly need to be queryable. Where a label is useful only for debugging, it may belong in logs or traces instead of metrics.

It also helps to treat series count as a first-class SLO input for observability platforms. Prometheus can be healthy on a quiet day and still fail under a burst of new series, so capacity planning should reflect the shape of the metrics model, not only the traffic rate.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

FrameworkControl / ReferenceRelevance
NIST CSF 2.0ID.AM-01 — Physical devices and systems within the organization are inventoriedActive series depend on knowing which monitored systems produce metrics.
PR.DS-01 — Data-at-rest is protectedPrometheus stores collected time-series data that must remain protected at rest.
GV.RM-01 — Risk management strategy is established and communicatedSeries-cardinality growth is an operational risk that needs explicit governance.
Recommendation — Inventory monitored systems so you can attribute series growth to specific sources. Protect stored metrics data and associated time-series blocks at rest. Set cardinality thresholds and review them as part of observability risk management.
CIS Controls v8CIS-5 — Account ManagementMetric label design often mirrors managed entities and access-related dimensions.
Recommendation — Limit unnecessary entity dimensions that inflate active-series growth.
NIST SP 800-53 Rev 5CM-7 — Least FunctionalityUnused metric dimensions increase system burden without operational value.
Recommendation — Disable or remove metric dimensions that do not support a clear monitoring purpose.

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org