coroot

What problem does it solve?

Coroot provides kernel-level observability to capture data that application-level metrics and logs miss, enabling accurate incident RCA, root-cause analysis, and risk assessment across complex infrastructures.

Core Features & Use Cases

• eBPF-powered data collection: captures kernel-level metrics including TCP connections, DNS queries, disk I/O, and per-container resource usage.
• Service map and topology, incident RCA: builds a live view of dependencies and enables end-to-end RCA across services, deployments, and nodes.
• Traces, logs, and costs/risk insights: correlates traces with logs and computes cost and risk signals for informed remediation.
• Use Case: during a cloud incident, correlate kernel-level events with application logs to determine if the root cause is a resource contention or a failed dependency.

Quick Start

Run coroot_get_incidents to fetch recent incidents and review their RCA summaries.