Keep is an open-source AIOps and alert management platform built with Python FastAPI and Next.js. It provides a single pane of glass for monitoring alerts from 110+ integrations, alert deduplication, correlation, enrichment, and filtering, YAML-based workflow automation similar to GitHub Actions, AI-powered correlation and summarization, and customizable dashboards for incident management. With 12,100+ GitHub stars, Y Combinator backing, and an Elastic partnership, Keep is the open-source AIOps platform that centralizes alert management across your entire monitoring stack into a single customizable dashboard. Alert deduplication identifies duplicate notifications across providers, correlation groups related alerts into incidents based on rules or AI-powered semantic analysis using pluggable LLM backends supporting OpenAI, Anthropic, and local models via Ollama, and enrichment adds context from external sources like CMDBs and databases. Workflow automation follows a GitHub Actions paradigm with declarative YAML files defining triggers, conditions, and actions that can query MySQL, update Jira tickets, send Slack messages, execute Python scripts, or call REST APIs. Authentication supports no-auth, database, Auth0, Keycloak, OAuth2 Proxy, Okta, and OneLogin. The Common Expression Language enables advanced alert querying, slicing, and rule-based grouping to reduce noise. On RepoCloud, deploy Keep on a dedicated VPS with Docker Compose, root SSH access, and complete control over your alert infrastructure, all under the MIT license.

OpsiMate gives on-call teams one queue for alerts that would otherwise arrive in five different dashboards, each demanding attention in its own tab. Connect Grafana, Datadog, Zabbix, Uptime Kuma, Google Cloud, or any custom webhook source and watch incoming alerts land in one table with their source, service, severity, tags, and status attached. Filter the noise down to the team or service you own, group related alerts so one incident does not look like forty separate emergencies, and use mute policies when a known problem should stop paging people. Acknowledge work with one click, assign ownership so nobody wonders who is responding, resolve alerts from the same screen, and follow deep links back into Grafana or Zabbix when you need the original chart or trigger. Let supported integrations auto-resolve alerts when the underlying monitor recovers, and use root-cause notes and insights to keep the next responder from starting at zero. Discover services running in Docker, Kubernetes, and Linux virtual machines so the alert queue stays connected to the infrastructure behind it. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

When a production alert fires at 3 a.m., Regen is the self-hosted on-call and incident management platform that makes sure a human answers it, keeping alerts, incidents, schedules, and escalations on one shared timeline instead of split across three tools. Alerts stream in from Prometheus Alertmanager, Grafana, AWS CloudWatch, or any webhook, and deduplication collapses repeat firings before Regen opens an incident automatically; responders can also declare one by hand and let AI draft the title and summary. Layered on-call rotations absorb overrides, holidays, and leave, while multi-step escalation policies with timeouts keep paging the next person until somebody acknowledges, so a critical page never dies in one inbox. The incident timeline syncs to Slack and Microsoft Teams, where bot commands acknowledge, escalate, and post updates without leaving chat, and Telegram notifications cover teams that live there instead. One-click summaries and handoff digests brief the incoming shift, editable postmortem drafts are assembled from the timeline using your own templates, and similar past incidents resurface with what worked last time. AI is bring-your-own-key through OpenAI, Anthropic, or a local Ollama model, and the platform loses nothing core if you never enable it. Schedules and escalation policies import in one click from PagerDuty, Grafana OnCall, or Opsgenie, SAML single sign-on through Okta, Azure AD, or Google Workspace is free, and nothing caps your incidents, schedules, or postmortems. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With 3,900 GitHub stars, 140 contributors, and 380 releases since its 2022 launch, Grafana OnCall delivers developer-friendly incident response that routes alerts from any monitoring system to the right engineer at the right time through the right channel. The platform accepts alerts via unique API URLs from Alertmanager, Grafana Alerting, Zabbix, Datadog, Pagerduty-compatible sources, Jira, inbound email, and generic HTTP webhooks, then applies routing templates to direct each alert to the appropriate escalation chain. Escalation chains define notification sequences — notify the primary on-call via Slack, wait 5 minutes, escalate to SMS and phone, wait 10 minutes, page the secondary on-call and notify the engineering manager — continuing until acknowledgment or resolution. On-call schedules support multi-layer rotations with overrides, shift swaps, and timezone-aware handoffs rendered directly inside Grafana dashboards. ChatOps integration publishes alert groups to Slack channels and Telegram groups with interactive buttons for acknowledge, resolve, and silence actions. Template engines based on Jinja2 control alert grouping, appearance rendering, and behavioral automation. The REST API enables programmatic management of integrations, schedules, and escalation policies. Deploy via Docker Compose with PostgreSQL, Redis, and Celery workers alongside your existing Grafana instance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GNU AGPL v3 licensed.

When a query crosses its threshold, Nightingale, a self-hosted alerting engine, decides who hears about it and how, without moving data out of the stores you already run. Rules use PromQL, log queries, or SQL against Prometheus, VictoriaMetrics, Elasticsearch, Loki, ClickHouse, MySQL, or PostgreSQL, graded S1, S2, or S3 with a for-duration that absorbs brief spikes. Existing Prometheus alert rules import from YAML. Business groups give each team its own rules and dashboards, and sign-in works through OIDC, OAuth2, LDAP, or CAS. Once a rule fires, mute rules silence the noise, subscriptions add recipients, and event pipelines rewrite labels or route conditionally. Delivery reaches Slack, PagerDuty, Discord, Telegram, Jira, email, DingTalk, Feishu, WeCom, SMS, and voice calls, plus HTTP webhooks and scripts for anything else. Evaluation records, active and historical events, and notification results show what happened at each step. If an alert misbehaves, the built-in AI agent explains why it fired or never arrived, and it drafts rules, dashboards, and mutes from plain-language requests. Claude Code, Cursor, and other MCP clients can query alerts and manage alerting through /mcp, read-only by default and bound by the caller's own permissions. At remote sites, n9e-edge keeps evaluating and notifying when the link to the center drops. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Alertmanager forgets an alert the moment it resolves; Jarvis remembers everything. This web frontend watches all your Alertmanager clusters at once and streams firing alerts into one live view over WebSocket, no refresh as problems appear or clear. Every alert's lifecycle is stored, so the resolved view answers how often something fired and how long it burned, and a grace period keeps a missed poll from being recorded as a phantom resolution. When an alert lands, claim it so the team sees who is on it, and leave comments bound to that alert fingerprint; notes survive restarts and re-fires, so the next person inherits the context. Silencing gets a rehearsal: preview exactly which alerts a silence will hit before creating it, fire a one-click Fast-Silence from the list, and save templates for recurring maintenance. Filters use the Alertmanager matchers you already know, save as named sets, ride in shareable URLs, and one can be your default view. Point Jarvis at every member of an HA gossip cluster and duplicates collapse by fingerprint, while protected upstreams authenticate with OAuth2, bearer tokens or basic auth per cluster. Sign-in is optional through built-in accounts or any OIDC provider, and it runs as one hardened container on port 8080, with PostgreSQL available when you want replicas. Keep it behind your VPN or an authenticating proxy, as its own docs insist. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With 7,400+ GitHub stars and a feature set that replaces seven separate SaaS subscriptions — Pingdom for monitoring, StatusPage.io for status pages, PagerDuty for on-call, Incident.io for incident management, Datadog for APM, Loggly for logs, and Sentry for error tracking — OneUptime delivers every tool your reliability team needs in a single open-source platform that is genuinely 100% open source under Apache 2.0 (not open-core). Uptime monitoring runs synthetic checks against websites, APIs, ports, SSL certificates, and DNS records from distributed global probes with configurable intervals and thresholds. Branded status pages publish automatically when monitors detect issues, notifying subscribers via email, SMS, webhook, or RSS without manual intervention during an outage. On-call scheduling routes alerts through escalation policies to the right engineer via phone call, SMS, push notification, Slack, or Microsoft Teams. The incident management workflow handles declaration, triage, communication, resolution, and post-mortem generation in a unified timeline. APM collects traces and metrics via native OpenTelemetry integration — no proprietary agents required — while log management provides full-text search and alerting. An AI agent continuously monitors telemetry data, identifies root causes, and opens GitHub pull requests with proposed fixes for review. Deploy via Docker Compose or Kubernetes Helm charts with a Terraform provider for infrastructure-as-code configuration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Monitoring everything from network switches to Kubernetes clusters since 2001 with over 6,200 GitHub stars and deployments exceeding 100,000 devices per installation, Zabbix has established itself as one of the most mature and feature-rich open-source monitoring platforms available, trusted by organizations including Dell, Salesforce, ICANN, and T-Mobile. The platform collects metrics from virtually any source using Zabbix Agent written in C, Zabbix Agent 2 written in Go with native plugin support, SNMP v1/v2c/v3 polling and trapping, IPMI for hardware health, JMX for Java applications, SSH and Telnet checks, HTTP/HTTPS polling, and ODBC database queries. Version 7.0 LTS introduced synthetic browser monitoring that executes user-defined JavaScript via WebDriver to simulate multi-step user interactions on websites, proxy load balancing with automatic host redistribution across proxy groups for high availability, in-memory proxy data buffering delivering up to 100x performance improvement, native multi-factor authentication with TOTP and Duo support, and just-in-time user provisioning from SAML and LDAP. Low-level discovery automatically detects file systems, network interfaces, SNMP OIDs, VMware resources, and Kubernetes pods, creating monitoring items and triggers dynamically. The alerting engine correlates events with configurable escalation chains, sending notifications through Slack, Microsoft Teams, PagerDuty, Jira, email, and SMS with customizable message templates. Over 1,000 official templates provide instant monitoring for Linux, Windows, VMware, AWS, Azure, Docker, PostgreSQL, MySQL, Apache, Nginx, and hundreds more. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With 20,500+ GitHub stars and over 6,000 organizations running it in production — including a Fortune 100 company ingesting more than 4 PB per day — OpenObserve is the open-source observability platform that replaces your entire Datadog, Splunk, or ELK stack with a single Rust binary deploying in under two minutes. Apache Parquet columnar storage with zstd compression on S3-compatible object storage delivers 140x lower storage costs than Elasticsearch while providing better query performance on a quarter of the hardware. Ingest logs, metrics, and distributed traces via native OpenTelemetry OTLP endpoints with no vendor lock-in. Query logs and traces with standard SQL, metrics with SQL or PromQL — no proprietary query language to learn. The built-in dashboard builder offers 19 chart types including time-series graphs, heatmaps, gauges, tables, and top-K lists with drag-and-drop layout combining data from all signal types. Data pipelines process, enrich, redact, or normalize ingestion streams using Vector Remap Language for real-time transformations including PII redaction and logs-to-metrics conversion. Real User Monitoring captures frontend performance with session replay. The Service Catalog provides topology-based trace analysis with side-panel drill-downs into database queries and error details. Alerting supports real-time and scheduled rules with SQL and PromQL conditions. Native multi-tenancy isolates organizations and streams with complete data separation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPLv3 licensed.

With over 31,000 GitHub stars and native OpenTelemetry support that eliminates vendor lock-in from day one, SigNoz delivers full-stack observability covering metrics, traces, and logs in a single pane of glass without the per-host pricing model of commercial APM platforms. The platform ingests telemetry data through the OpenTelemetry Collector, supporting auto-instrumentation for Java, Python, Node.js, Go, Ruby, PHP, and .NET applications with zero code changes required for basic tracing. ClickHouse serves as the columnar storage backend, providing fast aggregation queries over billions of spans and log lines with configurable retention policies and tiered storage. The distributed tracing view renders flame graphs and Gantt charts showing request flow across microservices with latency breakdowns, error rates, and p99 percentile calculations. Custom dashboards support PromQL and ClickHouse SQL queries with time-series charts, bar graphs, tables, and value widgets. The log management pipeline supports structured and unstructured logs with full-text search, log pipelines for parsing and enrichment, and correlation with traces via trace IDs. Alert rules can be configured on any metric or log query with notification channels including Slack, PagerDuty, OpsGenie, webhooks, and email. The exceptions monitoring module automatically groups and tracks application errors with stack traces, occurrence counts, and first-seen timestamps. Service maps visualize inter-service dependencies with real-time latency and error rate overlays. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed with an enterprise edition available.

The de facto dashboard of observability: Grafana is the open-source frontend that turns the data stores you already run into interactive graphs. It does not store metrics itself; it connects to the data stores you already run and turns their contents into interactive dashboards. Supported sources number over 150 via plugins: Prometheus, Loki, Tempo, InfluxDB, Elasticsearch, MySQL, PostgreSQL, Microsoft SQL Server, AWS CloudWatch, Azure Monitor, Google Cloud Monitoring, and many more. Dashboards are built from a large library of panel types (time series, heatmaps, tables, gauges, logs) with template variables for reusable, parameterized views. Unified alerting evaluates rules against any connected data source, not just Prometheus, and routes notifications to Slack, PagerDuty, email, and other channels with grouping and silencing - unlike Prometheus Alertmanager, a single rule can combine a Loki log pattern, a PostgreSQL query result, and a CloudWatch metric. Dashboards serialize to JSON and data sources configure via provisioning files, so the entire observability setup can live in Git and deploy repeatably across environments. Explore mode adds ad-hoc querying outside dashboards, with split view for correlating a metric spike against the matching log lines, and access control spans organizations, teams, folder permissions, and OAuth, LDAP, and SAML integration. Written in Go and TypeScript, AGPL-licensed. Self-hosting gives you unlimited users, dashboards, and queries at flat hosting cost, without Grafana Cloud's usage-based pricing.

When an alert fires on any of your Prometheus Alertmanagers, Karma shows it once, on one filterable dashboard, and lets you acknowledge or silence it from there. Identical alerts from different servers merge into one entry tagged with every server that saw it, HA pairs included. Groups follow the group_by settings of your Alertmanager routes, and shared labels and annotations collapse into a footer. Multi-grid mode gives each value of a label, or each Alertmanager, cluster, or receiver, its own grid, keeping production and staging apart. Configurable label colors make hosts and severities easy to spot. Optional history draws 24 hourly blocks per group from the Prometheus servers that fired it, and an inhibited alert's muted button lists whatever is suppressing it. One click acknowledges an alert with a short-lived silence, and the separate kthxbye daemon can keep extending it until the alert resolves. The silence modal creates, edits, and expires silences, and ticket IDs in comments can become links. A Dead Man's Switch check raises a visible error when the alerting pipeline goes quiet. Basic auth or a proxy's header identifies each user, silence ACLs stop one team from silencing another's alerts, and read-only mode disables silence management. Default filters open the view your team triages first, and light and dark themes follow the browser. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Servers, services, and network gear report their health to Icinga 2, the open-source monitoring core that runs checks, evaluates thresholds, and decides who gets woken up. A distributed hierarchy of master, satellite, and agent zones scales from a single box to global estates: satellites execute checks in remote regions and keep working when the master is unreachable, while agents run local checks under TLS-secured, certificate-based trust. The object-based configuration language defines hosts, services, dependencies, and notification rules as code, with apply rules generating checks across whole groups automatically. Performance data streams into Graphite, InfluxDB, or Elasticsearch writers, and Icinga DB carries runtime state and history into Redis and SQL for the web frontends. The REST API drives acknowledgements, downtimes, and check scheduling from scripts and chat tools, with fine-grained permissions down to diagnostic information. The 2.16 line hardens API security, streams richer runtime updates to Icinga DB for the new Icinga Notifications 1.0 incident workflows, and lets operators set exact acknowledgement times through the API. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0-or-later licensed.

When an alert fires, OnGrid investigates it for you: an AI operations agent that correlates metrics, logs, traces, and topology, then names the root cause in plain language. A coordinator agent hands each question to specialist SRE, network, or database sub-agents, and the incident investigator walks the service graph for blast radius, queries Prometheus, Loki, and Tempo, and pins the cause to a line of source code before posting its report back to chat. Lightweight edge agents on every host dial out over a single tunnel, so no inbound ports are opened, and operators can reach any machine through an audited browser shell. The agent works through more than 26 read-only inspection tools in a sandbox, while anything that changes production waits behind an approval gate. Ask questions or receive reports in Slack, Telegram, Larksuite, DingTalk, or WeCom, and run it on Anthropic, OpenAI, GLM, DeepSeek, Gemini, Kimi, or any OpenAI-compatible endpoint. A workflow builder turns triggers, agents, tools, and notifications into repeatable automations, and a knowledge vault indexes runbooks, incident history, and repositories for search. Enroll Kubernetes clusters to inspect workloads and manage upgrades, or discover network neighbors, verify them over SNMP, and map them into the topology. Role-based access separates admins, users, and viewers. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Versus Incident is a self-hosted AI SRE agent and incident manager that learns what normal looks like in your logs, metrics, traces, and Kubernetes clusters, then opens a triaged incident the moment something genuinely new appears. Detection earns trust gradually. Training mode only observes and catalogs patterns; shadow mode records what it would have alerted so you can judge its instincts; detect mode creates real incidents with an AI-written summary, a severity, and suggested next steps attached. Existing alerting does not have to move: Alertmanager, Grafana, Sentry, CloudWatch, Fluent Bit, and custom scripts post to the same webhook endpoint, and every incident, however it arrived, is rendered with your Go templates. Delivery fans out to Slack, Microsoft Teams, Telegram, Viber, email, and Lark. Silence has a deadline, because unacknowledged incidents escalate to on-call through PagerDuty, AWS Incident Manager, Opsgenie, incident.io, or ServiceNow. The Kubernetes dashboard gathers cluster health and capacity, workloads, resource relationships, recent changes, Helm releases, and GitOps status, and a DevOps chat agent in the web UI answers questions against the connected systems while responders work. The admin dashboard reviews learned patterns, shadow events, and raised incidents, so the agent's judgment stays inspectable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Sensors watch your infrastructure so your engineers do not have to watch it at 3 a.m. StackStorm is event-driven automation: Python sensors poll or listen to external systems (monitoring alerts, ticket updates, chat messages, webhooks, timers) and inject each event as a trigger. Rules match triggers against criteria you define and fire the response automatically, mapping the event payload straight into action parameters. Actions do the work: SSH commands, REST calls, and integrations for AWS, Docker, OpenStack, Puppet, Jira, Slack, and hundreds more from community packs, or your own scripts wrapped with a few lines of metadata. Multi-step responses become workflows that sequence actions with conditions, branching, and data passed between tasks, handling everything from disk-full remediation to full deployment pipelines. Everything bundles into packs, the shareable units that group sensors, rules, actions, and workflows per product or per automation, installable from the StackStorm Exchange or your own Git repositories. The web UI runs actions, explores workflow executions down to individual task results in real time, manages rules, and installs packs, while every execution, manual or automated, lands in an audit trail with its triggering context. ChatOps aliases even let the team trigger approved automations from chat. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

One REST call, 130+ notification services: Apprise API wraps the well-known Apprise library in a lightweight Django/Gunicorn microservice, so "send an alert" works the same whether it goes to Slack, Discord, Telegram, Teams, email, SMS, Pushover, or PagerDuty - each addressed by a simple URL scheme. It solves the credential-sprawl problem cleanly: instead of embedding provider tokens in every app, cron job, and CI pipeline, you centralize them here and everything else just POSTs a body and title. Two modes cover every workflow. Stateless calls to /notify carry target URLs in the payload (or fall back to a default set via APPRISE_STATELESS_URLS); stateful mode stores named configurations server-side under keys, so /notify/{KEY} fans out to everything registered - with tag-based routing (comma for OR, space for AND) selecting which endpoints fire per message. Messages take info, success, warning, or failure types in text, Markdown, or HTML, with attachments up to a configurable size. A built-in web UI manages and tests configurations, APPRISE_CONFIG_LOCK makes the store read-only, service allow/deny lists restrict which schemes work, webhook remapping adapts third-party payloads, and a Prometheus /metrics endpoint watches the gateway itself.

ntfy sends push notifications to your phone or desktop with a single curl command: publish a message to any topic and every subscriber receives it instantly, no signup or API key required. Over 31,000 GitHub stars and 106 releases since 2021 back a server supporting five priority levels mapped to distinct notification sounds and vibration patterns, emoji tags for visual classification, click actions that open URLs when tapped, and up to three action buttons per notification for view, HTTP callback, broadcast, or clipboard copy operations. File attachments push images from surveillance cameras, documents, or any binary payload directly to mobile devices. Subscriptions work through JSON streams, Server-Sent Events, WebSockets, or raw text, with server-side filtering by priority, tags, and message ID. Authentication enforces topic-level access control through Basic Auth, Bearer tokens, or query parameters, with a built-in user and ACL management system. UnifiedPush compatibility lets ntfy serve as a push distributor for Mastodon, Matrix, and other federated services. Web Push via VAPID keys delivers browser notifications without the mobile app. The server ships as a single statically linked Go binary or Docker image supporting amd64, armv7, and arm64 architectures, consuming 30-50 MB RAM at idle with SQLite-backed message caching. Integrations include Grafana, Prometheus Alertmanager, Uptime Kuma, Home Assistant, and Ansible Semaphore. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 / GPLv2 dual-licensed.