OpsCat pulls your logs, events, synthetics, SNMP and server metrics into one lightweight, self-hostable platform. It classifies noise into real incidents, measures latency from a global sensor mesh, and keeps a public status page honest — so your NOC sees the whole picture on one pane of glass.
Built for the teams who get paged at 3am
From the first log line to a public status page — OpsCat covers ingestion, correlation, synthetics and alerting without a rack of separate tools to wire together.
Ship logs over plain HTTPS from anywhere: a dependency-free JS SDK, OTLP/OpenTelemetry logs & traces, Sentry, or a raw curl. And for the switches, firewalls and appliances you cannot install anything on — syslog, RFC 5424 and RFC 3164, straight to a TLS endpoint, through a collector you run yourself, or over a WireGuard tunnel where plain UDP still works. No agent lock-in.
Every line is classified and scored 0–100, deduped into live events, and auto-escalated into cases (C-1xxx) when it matters. Noise in, incidents out.
HTTP, ICMP, DNS, TCP and traceroute checks from the platform host plus any number of remote probes. Latency, jitter, loss and hops per region.
Point it at your sending domain and it reads the SPF record to find the servers that actually send for you — including the forgotten relay nobody would think to look up. Then checks them against 31 IP and 8 domain blocklists — including the servers behind your MX records, because a listed mail server refuses inbound mail and no domain-level check will tell you. A listed sender is perfectly reachable — it just stops being delivered, so it gets its own alert instead of hiding behind an uptime check. Every finding carries its delisting link — and every listing is kept as an episode with a start and an end, so you can say how long you were listed, not just that you are.
Poll network gear over SNMP v2c on its own interval — sysUpTime, interface status and custom OIDs. Unreachable targets and down links raise events automatically.
One single-file, dependency-free agent reports heartbeat, CPU/RAM/disk/network metrics and optional journald logs. The same binary doubles as a remote probe.
Rules match on trigger name, minimum severity and cooldown, then fan out to Resend e-mail, Microsoft Teams or a generic webhook. Every notification is recorded.
Open an incident, build the timeline, write the RCA — then publish a clean status page with 45 days of per-component uptime. Your logo, your colours, light or dark — branding is included on every plan. Run it on status.yourdomain.com, and give partners their own private page.
A fast SPA at /app streams logs and events over SSE — dashboards, cases, analytics, a terminal-style Classic View, plus user & API-key management.
The pipeline turns a firehose of raw lines into scored events, opened cases, fired alerts and an honest status page — automatically, in-process, no queue to babysit.
Point the SDK, an OTLP exporter, Sentry, an agent or a curl at /v1/ingest. API-key auth, scoped and hashed.
Regex classifiers score each line 0–100. Lines ≥20 become deduped events; ≥60 auto-open a case with sparklines and first/last seen.
Rules fire e-mail, Teams or webhooks on cooldown. Declare an incident and the public status page updates itself.
Global sensors run synthetic checks against your endpoints, so slow-from-São-Paulo shows up before your users tell you.
The full OpsCat core is Apache-2.0 licensed and self-hostable — the same engine that powers OpsCat Cloud. One docker compose up gives you the API, engines, UI and status page behind Caddy with automatic TLS. No feature gate on your own hardware.
It is deliberately small: two databases and nothing else. No search cluster, no message broker, no JVM, no queue. Events, cases, incidents and users live in PostgreSQL; raw log lines live in ClickHouse, because they are the one thing that is append-only, never updated and large — about 14× less disk per line and full-text search an order of magnitude faster.
The whole thing runs on a 2-vCPU / 4 GB VM at around 870 MB. That is the honest number with both databases in it, measured on our own production host after days of real traffic rather than seconds after boot — and the two are capped at 1 GB and 1.5 GB, so the ceiling is something you can plan against.
We run it, patch it and scale the sensor mesh. Start free, upgrade when your team grows. Google SSO, priority support and every region on tap.
Clone the repo, bring your own VPS, own every byte. Unlimited users and checks, retention you set yourself — capped only by your hardware.
Spin up remote probes in minutes — the same lightweight agent in --probe mode. Every synthetic check reports latency, jitter and loss per region, and failures flow straight into the event pipeline.
Create a scoped API key in the UI under Settings → API & Access, then ship a line. Roll the agent onto your fleet with a one-liner and metrics start flowing immediately.
# 1 · Ship a log line — from any language, or curl curl -X POST https://opscat.io/v1/ingest/logs \ -H "Authorization: Bearer ock_YOUR_KEY" \ -H "Content-Type: application/json" \ -d '{"logs":[{"device":"web-01", "line":"kernel: Out of memory: Killed process 4242", "sev":2}]}' # 2 · Roll the agent onto a server (metrics + logs) curl -fsSL https://opscat.io/agent/install.sh \ | sh -s -- --key ock_YOUR_KEY # → tail it live in the dashboard at /app
Self-host the open core for nothing, or let OpsCat Cloud carry the pager. Simple, honest tiers — no per-host tax, no surprise overage.
Nine lives for your uptime
Logs, events, synthetics, SNMP and status pages — self-hosted or in the cloud. Set it up before your next on-call shift.