With 20,500+ GitHub stars and over 6,000 organizations running it in production — including a Fortune 100 company ingesting more than 4 PB per day — OpenObserve is the open-source observability platform that replaces your entire Datadog, Splunk, or ELK stack with a single Rust binary deploying in under two minutes. Apache Parquet columnar storage with zstd compression on S3-compatible object storage delivers 140x lower storage costs than Elasticsearch while providing better query performance on a quarter of the hardware. Ingest logs, metrics, and distributed traces via native OpenTelemetry OTLP endpoints with no vendor lock-in. Query logs and traces with standard SQL, metrics with SQL or PromQL — no proprietary query language to learn. The built-in dashboard builder offers 19 chart types including time-series graphs, heatmaps, gauges, tables, and top-K lists with drag-and-drop layout combining data from all signal types. Data pipelines process, enrich, redact, or normalize ingestion streams using Vector Remap Language for real-time transformations including PII redaction and logs-to-metrics conversion. Real User Monitoring captures frontend performance with session replay. The Service Catalog provides topology-based trace analysis with side-panel drill-downs into database queries and error details. Alerting supports real-time and scheduled rules with SQL and PromQL conditions. Native multi-tenancy isolates organizations and streams with complete data separation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPLv3 licensed.

Trusted by over 60,000 organizations worldwide with more than 8,100 GitHub stars since 2010, Graylog has established itself as one of the fastest paths from raw log data to operational visibility, delivering centralized log management, security analytics, and compliance auditing through a purpose-built web interface with sub-second search at scale. The platform ingests logs from virtually any source via syslog, GELF, Beats, raw TCP/UDP, HTTP, CEF, IPFIX, and Netflow protocols, processing each message through configurable pipelines that parse fields, apply transformations, enrich events with GeoIP data from MaxMind or IPinfo lookup tables, and route messages to appropriate streams based on content rules. OpenSearch handles full-text indexing and storage with dynamic shard sizing that automatically calculates appropriate sizes from available node memory, while MongoDB stores configuration metadata including user accounts, roles, dashboards, alert rules, and pipeline definitions. The alerting system integrates with Slack, PagerDuty, and email with customizable notification templates and Replay Search links for immediate investigation context. Version 7.0 introduced MCP server integration for connecting preferred LLMs to perform AI-assisted log analysis and automation, while version 7.1 added Sigma detection rule import from private GitHub, GitLab, and Bitbucket repositories for detection-as-code workflows. The Sidecar agent management system centrally configures and deploys Filebeat, Winlogbeat, and nxlog collectors across infrastructure from the Graylog web interface. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. SSPL licensed.

With over 28,600 GitHub stars and 450 contributors, Grafana Loki is the log aggregation system that takes the Prometheus approach to logging — indexing only metadata labels instead of full log content, making it dramatically cheaper and simpler to operate than traditional log management platforms. The label-based indexing strategy groups log streams using the same labels already applied to Prometheus metrics, enabling seamless switching between metrics and logs in Grafana dashboards without maintaining separate indexing infrastructure. Grafana Alloy, the telemetry collector replacing Promtail, scrapes and pushes logs with Prometheus-style service discovery, automatic Kubernetes Pod label extraction, and pipeline stages for parsing, filtering, and relabeling before ingestion. LogQL, the query language, combines label matchers for stream selection with regex line filters and aggregation functions, supporting rate calculations, pattern parsing, and metric generation from log data for alerting and dashboard panels. The storage architecture writes compressed log chunks and TSDB indexes to S3, GCS, Azure Blob Storage, or MinIO-compatible object stores, with configurable retention and compaction policies. Deployment modes scale from a single binary for development through monolithic high-availability mode with multiple replicas to full microservices decomposition with separate ingester, distributor, querier, query-frontend, compactor, and ruler components on Kubernetes via Helm charts. Multi-tenancy isolates data and query paths per tenant through header-based tenant ID assignment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Instead of running an Elasticsearch or Loki cluster, VictoriaLogs stores and searches your logs from a single zero-config server. Ship from Filebeat, Fluent Bit, Fluentd, Logstash, Vector, Promtail, Telegraf, the OpenTelemetry Collector, or the Datadog Agent. Syslog, journald, and Splunk endpoints work too. Query with LogsQL: word, phrase, and prefix filters combine with pipes that extract fields from raw lines and compute stats, top values, and facets. See results as a table, grouped by stream, as raw JSON, or as a live tail. Chart them in Grafana, or work from a terminal with vlogscli and pipe output into grep, less, or jq. Events with hundreds of fields are supported. So are high-cardinality fields like trace_id and user_id. Late, out-of-order backfills are accepted. During an incident, stream_context pulls the lines around any match. Tenants are keyed by AccountID and ProjectID headers. vmalert evaluates LogsQL queries as alerting and recording rules. CEF messages sent over Syslog are parsed automatically for SIEM work. Retention defaults to 7 days and can be capped by disk space. Per-day partitions snapshot and copy out with rsync or rclone. Cluster mode splits ingestion, querying, and storage across nodes for logs that outgrow one server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Parseable replaces expensive Elasticsearch clusters and fragmented monitoring stacks with a single Rust binary that ingests, queries, and stores logs, metrics, and traces on commodity object storage at a fraction of the cost. The data lake architecture decouples stateless compute from S3-compatible storage, enabling independent scaling of ingestion throughput and query capacity while cutting storage costs by up to 90% compared to indexed alternatives. OpenTelemetry-native OTLP ingestion accepts telemetry from existing OTel collector pipelines, Prometheus Remote Write endpoints, Kafka consumers, eBPF probes, and popular logging agents including Fluentd, Fluent Bit, and Vector without proprietary format conversions. The SQL-first query interface enables cross-signal analysis across all telemetry types, while native PromQL support with 50+ functions and 12 aggregation operators provides Prometheus-compatible metrics querying that works directly with Grafana dashboards. Built-in features include customizable dashboards, real-time alerting with Webhook, Slack, and Alertmanager targets, role-based access control, OpenID single sign-on integration, LogIQ automatic unstructured-to-structured log transformation, smart caching for frequently accessed data, and retention policies for lifecycle management. AI-powered Keystone Q&A provides natural language to SQL conversion and dataset summarization. All data stored as standard Apache Parquet on object storage remains accessible to any Parquet-compatible engine (DuckDB, Spark, Trino), ensuring zero vendor lock-in. Deploys on AWS S3, Azure Blob, Google Cloud Storage, MinIO, Wasabi, and DigitalOcean Spaces. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 11,000 GitHub stars and now backed by Datadog while remaining fully Apache 2.0 licensed, Quickwit delivers the search performance Elasticsearch users expect at a fraction of the infrastructure cost by moving the index to object storage instead of expensive local SSDs. The Rust-based engine, built on the Tantivy search library with SIMD-accelerated vectorized processing and zero garbage collection overhead, achieves sub-second search latency directly against Amazon S3, Azure Blob Storage, Google Cloud Storage, or any S3-compatible backend like MinIO and Ceph. The Elasticsearch-compatible REST API covers ingest, search, query DSL, and aggregations, enabling existing log shippers including Vector, Fluent Bit, and Syslog to migrate without rewriting configurations. Native OpenTelemetry Protocol endpoints accept logs and traces via gRPC, while Jaeger integration provides a drop-in distributed tracing backend. Ingestion from Apache Kafka, Amazon Kinesis, and Apache Pulsar supports streaming pipelines with multi-index partitioning, and the schemaless JSON indexing mode eliminates the need for upfront schema definitions. Stateless searchers and indexers scale horizontally on Kubernetes or bare metal, with a control plane that distributes indexing tasks and a janitor that manages retention policies and GDPR-compliant deletions. The built-in web UI displays search results and cluster state, while the official Grafana data source enables log exploration dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

ClickStack is an open-source observability platform that unifies logs, metrics, traces, session replays, and errors in one searchable interface, so engineers can move from an alert to the exact request that broke in minutes. Search uses an intuitive full-text and property syntax (for example level:err), with SQL available when a question needs full analytical power. Live tail streams fresh logs and traces as they arrive, and event deltas surface anomalies by comparing current behavior against earlier windows. Dashboards chart high-cardinality events without a complex query language, and alerts can be created in a few clicks from any search or chart. Session replays connect a user's browser experience to the backend traces and database queries behind it, giving full-stack visibility from click to query. Native JSON string querying handles nested payloads, and the schema-agnostic design works on top of an existing ClickHouse schema instead of forcing a new one. OpenTelemetry is supported out of the box, with SDKs and collectors for Kubernetes, JavaScript, Python, Java, Go, Ruby, PHP, .NET, Elixir, and Rust. The all-in-one Docker image bundles the interface, ClickHouse, the OpenTelemetry Collector, and supporting services on port 8080, and a terminal CLI serves engineers who prefer the shell. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Four log stores should not mean four tools open during an outage, and Telescope is a web log viewer that explores ClickHouse, StarRocks, Docker, and Kubernetes logs in one place. Connect multiple sources, decide which fields each one exposes, mark fields as suggested or hidden, and enable autocompletion so everyday lookups start with structured filters rather than query syntax. When filters are not enough, drop into raw SQL with full WHERE expressions, choose the columns and formatting you want, and narrow results with a time selector that understands relative ranges. Group logs by any field, including nested JSON, map, and array values, and read the interactive chart to spot spikes and anomalies without hand-writing aggregation queries. Save the filter combinations your team reaches for during incidents, share those views, and jump straight to the logs that matter next time. Control who sees what with per-source user and group permissions, GitHub authentication with organization checks, and role-based access for querying. Collapse the sidebar into focus mode when the screen should belong to log lines alone, whether you are chasing container output locally or production records at scale. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

HyperDX correlates logs, metrics, traces, session replays, and errors in a single interface so engineers can resolve production incidents in minutes instead of hours. Nearly 10,000 GitHub stars reflect its role as the integrated UI layer for the ClickStack blueprint endorsed by ClickHouse. The platform connects to any ClickHouse cluster as its storage backend, working with existing table structures without requiring data migration or proprietary ingestion formats. An intuitive Lucene-like search syntax supports full-text queries and property filtering like level:err or service.name:api without needing SQL, while native JSON string querying and event delta analysis surface anomalies in high-cardinality datasets. One-click cross-signal correlation lets you jump from a log line to its distributed trace, from a slow span to associated logs, or from a frontend session replay to the backend errors it triggered. The OpenTelemetry Collector accepts telemetry via OTLP on gRPC port 4317 and HTTP port 4318, supporting automatic instrumentation for Node.js, Python, Java, Go, Ruby, and browser applications. APM tracks HTTP request latency, database query duration, and external service calls with trace waterfall visualizations. Configurable alerts trigger via webhook, Slack, PagerDuty, or email when thresholds are breached. Deploys via Docker Compose with ClickHouse, MongoDB, Redis, and the OpenTelemetry Collector. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Across logs, traces, and metrics, Monoscope gives engineering teams one self-hosted workspace for finding what broke, asking questions in plain English, and hearing about problems before users do. Start in the Explorer: search events with KQL or an Ask AI prompt, flip between log rows, bar and line charts, log patterns, and sessions, and narrow results with facets for service, level, and HTTP status. Open any span to read its attributes, then follow the full trace across services in a waterfall, timeline, or map view. Live Tail streams new events as they arrive, and the Service Map draws every dependency with its error rate, latency, and requests per second. Build dashboards from widgets with copyable KQL and SQL, then set scheduled monitors with warn and alert thresholds, cron monitors, and uptime checks. An Issues inbox gathers API changes, errors, and log patterns so each one can be acknowledged, archived, or marked as spam, while Reports send scheduled summaries by email. Telemetry arrives over OTLP gRPC on port 4317 from OpenTelemetry SDKs and collectors. The monoscope CLI emits JSON for scripts, and an MCP server at /api/v1/mcp lets Claude, Cursor, and Cline search events and triage issues. Natural-language search uses the OpenAI-compatible model you configure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 31,000 GitHub stars and native OpenTelemetry support that eliminates vendor lock-in from day one, SigNoz delivers full-stack observability covering metrics, traces, and logs in a single pane of glass without the per-host pricing model of commercial APM platforms. The platform ingests telemetry data through the OpenTelemetry Collector, supporting auto-instrumentation for Java, Python, Node.js, Go, Ruby, PHP, and .NET applications with zero code changes required for basic tracing. ClickHouse serves as the columnar storage backend, providing fast aggregation queries over billions of spans and log lines with configurable retention policies and tiered storage. The distributed tracing view renders flame graphs and Gantt charts showing request flow across microservices with latency breakdowns, error rates, and p99 percentile calculations. Custom dashboards support PromQL and ClickHouse SQL queries with time-series charts, bar graphs, tables, and value widgets. The log management pipeline supports structured and unstructured logs with full-text search, log pipelines for parsing and enrichment, and correlation with traces via trace IDs. Alert rules can be configured on any metric or log query with notification channels including Slack, PagerDuty, OpsGenie, webhooks, and email. The exceptions monitoring module automatically groups and tracks application errors with stack traces, occurrence counts, and first-seen timestamps. Service maps visualize inter-service dependencies with real-time latency and error rate overlays. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed with an enterprise edition available.

Moneat is the open-source observability platform that unifies error tracking, session replay, performance monitoring, logging, uptime checks, synthetics, product analytics, and AI observability into a single self-hosted application — replacing Sentry, Datadog, and Statuspage with one deployment. The Sentry SDK compatibility layer accepts data from @sentry/browser, @sentry/node, @sentry/react, @sentry/nextjs, sentry-sdk for Python, sentry-kotlin, sentry-java, sentry-android, sentry-cocoa, sentry-go, sentry-ruby, and Sentry.NET by updating one DSN endpoint. Datadog Agent compatibility redirects existing fleets by setting dd_url, and native OpenTelemetry OTLP ingestion accepts logs, traces, and metrics from any exporter or Collector. Error monitoring groups exceptions with smart deduplication, session replay records DOM-based user interactions linked to errors, distributed tracing visualizes transaction and span breakdowns with live service maps, and continuous profiling renders flamegraphs in pprof, JFR, and Sentry formats. Uptime monitoring runs HTTP, TCP, and ping checks with public status pages, while synthetics executes API tests, multi-step workflows, SSL checks, and DNS probes. Custom dashboards support drag-and-drop widgets with Grafana import, product analytics provides funnels and retention cohorts, release tracking surfaces crash-free rates with source map upload, and AI observability traces LLM calls end to end. Built on Kotlin and Java with ClickHouse for analytical storage, PostgreSQL for relational data, and Redis for caching, deployment uses Docker Compose with an interactive installer automating secrets and service orchestration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

The de facto dashboard of observability: Grafana is the open-source frontend that turns the data stores you already run into interactive graphs. It does not store metrics itself; it connects to the data stores you already run and turns their contents into interactive dashboards. Supported sources number over 150 via plugins: Prometheus, Loki, Tempo, InfluxDB, Elasticsearch, MySQL, PostgreSQL, Microsoft SQL Server, AWS CloudWatch, Azure Monitor, Google Cloud Monitoring, and many more. Dashboards are built from a large library of panel types (time series, heatmaps, tables, gauges, logs) with template variables for reusable, parameterized views. Unified alerting evaluates rules against any connected data source, not just Prometheus, and routes notifications to Slack, PagerDuty, email, and other channels with grouping and silencing - unlike Prometheus Alertmanager, a single rule can combine a Loki log pattern, a PostgreSQL query result, and a CloudWatch metric. Dashboards serialize to JSON and data sources configure via provisioning files, so the entire observability setup can live in Git and deploy repeatably across environments. Explore mode adds ad-hoc querying outside dashboards, with split view for correlating a metric spike against the matching log lines, and access control spans organizations, teams, folder permissions, and OAuth, LDAP, and SAML integration. Written in Go and TypeScript, AGPL-licensed. Self-hosting gives you unlimited users, dashboards, and queries at flat hosting cost, without Grafana Cloud's usage-based pricing.

Trusted by millions of engineers and deployed on over 80,000 GitHub stars worth of community confidence, Netdata delivers true real-time monitoring at per-second granularity — 10-60x faster than Prometheus, Datadog, or any conventional monitoring stack that averages away the transient anomalies lasting 2-10 seconds where most production incidents originate. A single installation command deploys the agent with zero configuration, automatically discovering every running process, container, systemd service, network connection, disk, and application on the host within seconds. Unsupervised machine learning trains multiple models per metric directly at the edge, detecting anomalies without thresholds, baselines, or manual tuning. The distributed Parent-Child architecture scales horizontally from a single Raspberry Pi to fleets exceeding 100,000 nodes while maintaining sub-2-second visualization latency and storing metrics at approximately 0.5 bytes per sample through tiered compression. Native network monitoring provides live topology maps, NetFlow and sFlow analytics, SNMP device polling across 200+ profiles, and trap handling — capabilities that typically require a separate NPM product. Hundreds of pre-configured alerts cover systems and applications out of the box, with AI-powered root cause analysis surfacing correlated metrics through natural language via MCP-compatible AI assistants. The agent supports Linux, macOS, FreeBSD, Kubernetes, and Docker with eBPF-based kernel observability requiring no application instrumentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL v3+ licensed.

Monitoring everything from network switches to Kubernetes clusters since 2001 with over 6,200 GitHub stars and deployments exceeding 100,000 devices per installation, Zabbix has established itself as one of the most mature and feature-rich open-source monitoring platforms available, trusted by organizations including Dell, Salesforce, ICANN, and T-Mobile. The platform collects metrics from virtually any source using Zabbix Agent written in C, Zabbix Agent 2 written in Go with native plugin support, SNMP v1/v2c/v3 polling and trapping, IPMI for hardware health, JMX for Java applications, SSH and Telnet checks, HTTP/HTTPS polling, and ODBC database queries. Version 7.0 LTS introduced synthetic browser monitoring that executes user-defined JavaScript via WebDriver to simulate multi-step user interactions on websites, proxy load balancing with automatic host redistribution across proxy groups for high availability, in-memory proxy data buffering delivering up to 100x performance improvement, native multi-factor authentication with TOTP and Duo support, and just-in-time user provisioning from SAML and LDAP. Low-level discovery automatically detects file systems, network interfaces, SNMP OIDs, VMware resources, and Kubernetes pods, creating monitoring items and triggers dynamically. The alerting engine correlates events with configurable escalation chains, sending notifications through Slack, Microsoft Teams, PagerDuty, Jira, email, and SMS with customizable message templates. Over 1,000 official templates provide instant monitoring for Linux, Windows, VMware, AWS, Azure, Docker, PostgreSQL, MySQL, Apache, Nginx, and hundreds more. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Docker Updater puts you back in charge of container updates: it watches your registries for newer images, and nothing updates until you approve it, so no database restarts itself at dinner. Polls run on a schedule you set, and each container card shows the newer image waiting before anything is pulled. The check costs nothing: it compares the digest your container runs against the registry manifest without pulling a byte, across Docker Hub, GHCR and other Bearer-token registries. Read the last five GitHub releases for an image before committing, update one container or a batch, and watch the pull percentage, layer count and recreation step stream live on the card. If the new container fails to start, the old one returns automatically, and you can keep a backup even after a clean update. Not ready? Defer an update for 7, 14, 30 or 90 days, or indefinitely, and it leaves your notifications alone until then. Several Docker hosts join the same dashboard over SSH or TCP with health indicators, and Compose stacks restart together so services find new addresses. Notifications arrive through an auto-generated ntfy topic or your own Apprise URL, every update keeps a persistent log, and a reclaimable-images view shows what disk space old images hold. The dashboard serves on port 9090 in English or Simplified Chinese, with optional login. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.