No SDK, no code changes
Point it at a Docker container or a log file. Works with old apps, third-party apps and anything that writes logs.
Self-hosted AI on-call for your logsMillions of log lines in.
Millions of log lines in.
One ticket that explains why.
Agentic Monitoring reads your containers and log files around the clock, groups repeated errors into patterns, sends an AI agent to find the cause in your logs and code, and posts a ticket your team can act on.
The problem
One bug writes the same error ten thousand times. Nobody reads them until a customer complains.
Alerts fire on every line, so people mute them. When something does break, someone still has to dig through the logs, find the cause and write the ticket by hand. That takes the first half hour of every incident.
1,284,331lines read today
4error patterns
1new ticket
How it works
From a wall of logs to a ticket, in four steps.
docker · checkout-api
14:02:10 INFO deploy finished version=41
14:02:11 ERROR pool exhausted (max=20) after 30 tries
14:02:11 INFO GET /orders/8812 200 12ms
14:02:12 ERROR pool exhausted (max=20) after 31 tries
14:02:12 WARN slow query took 812ms
14:02:13 ERROR pool exhausted (max=20) after 31 tries
14:02:13 INFO password=[REDACTED] user login ok
14:02:14 ERROR pool exhausted (max=20) after 33 tries
secrets and emails are redacted before anything is storedNoise into patterns
Forty-eight thousand lines. Six things actually happened.
Each dot is one log line. Scroll and watch them fall into patterns. The AI only looks at a pattern when it is new or suddenly spiking, so your bill follows the number of problems, not the number of lines.
48,210 lines
pool exhausted (max=<*>) after <*> tries22,177slow query took <*> on table orders9,642retrying request to billing attempt=<*>6,749upstream timeout calling billing after <*>4,821cache miss ratio <*> above threshold3,375disk usage <*> on /data1,446Features
Everything an on-call engineer does first, done before they wake up.
Runs on your own server
One small container next to your apps. Logs never leave your VPS except the redacted snippets the agent reads.
An agent that shows its work
Every ticket has a likely cause, the log lines, code and commits behind it, and a confidence score. Weak evidence is flagged for review.
Port and URL checks
Probe TCP ports and HTTP endpoints on a schedule. When a service goes down, you get told; when it comes back, the ticket says so.
Configured in the dashboard
Pick containers from a list, add checks, choose models and connect Slack in the browser. Changes apply without a restart.
Cost you can predict
The agent runs only for new or spiking patterns, within an hourly limit and a daily token budget you set.
Bring your own key
Use the AI provider you already pay for.
Add a provider in the dashboard with your own API key. Keys are encrypted on your server and never sent back to the browser. Anything that speaks the OpenAI chat API works, including a model running locally.
Anthropic Claudenative APIOpenAIcompatibleGoogle GeminicompatibleOpenRoutercompatibleGroqcompatible
DeepSeekcompatibleMistralcompatiblexAIcompatibleTogethercompatibleOllamaon your own machine
Stage 1 · Triage
Is this worth a look?
One short call per new pattern decides whether it is noise or a real problem. A small, fast model is enough here.
e.g. a fast, low-cost modelStage 2 · Investigation
Why is it happening?
The agent reads logs, code and commits over several steps. Use the strongest model you have that supports tool calling.
e.g. Claude Opus or another top modelSafety
An AI that reads your logs should not be able to touch anything.
The agent can only read
Its tools search logs, read files and read git history. It cannot change your server, your code or your containers.
Secrets are removed first
Passwords, tokens, API keys, emails and credentials in URLs are redacted before a line is stored or shown to a model.
Docker access is read-only
A small proxy lets it read container info and logs, and refuses every request that would change something.
Your keys stay encrypted
AI keys, the Slack webhook and the GitHub token are encrypted with AES-256-GCM and never returned to the browser.
Guesses are labelled
Each claim must point to a log line, a file or a commit. Low confidence or missing evidence marks the ticket for review.
Limits you control
An hourly cap on investigations, a daily token budget, and a cap on incidents per source keep a log flood from becoming a bill.
Built to be light
Small enough to sit next to your apps.
0log lines processed per second
0%of lines kept on disk, with the context around each error
0 MBpeak memory while processing a million lines
0ticket per pattern; repeats become comments
Throughput, storage and memory were measured with the bundled load test on a development laptop. Run it on your own server for numbers that match your hardware.
Deploy
Push to your Git server. It deploys itself.
No config files on the server and no secrets in the pipeline. Everything else is set in the dashboard.
- Add a GitLab runner on your VPS
One Docker command. It builds the image on the same machine, so no registry is needed.
- Push to main
The pipeline runs the tests, builds the image and starts the stack, then waits for the health check.
- Open the dashboard
Create the admin password, add your AI key, pick containers to watch and connect Slack.
$
FAQ
Questions people ask first.
No. It reads the logs your apps already write, from Docker containers or log files. There is no SDK to install.
Let the night shift read the logs.
Self-hosted, no SDK, your own AI key. Push once and open the dashboard.