Open Source PagerDuty Alternatives

Alerts arrive from a dozen different tools, each with its own console. Keep is an open source AIOps and alert management platform that puts them behind a single pane of glass, where deduplication, enrichment, filtering and correlation happen in one place and integrations sync in both directions instead of only ingesting.

Automation is modeled on GitHub Actions. A workflow is a declarative YAML file with triggers that start it, an alert, an incident, a schedule or a manual run, steps that fetch data for context, and actions that do something, such as opening a Jira ticket, messaging a Slack channel or restarting a server. Conditions and loops steer the path, and results are written back onto the alert as enrichment.

The provider catalog is where most of the surface area sits.

• Observability: Datadog, Grafana, Prometheus, Sentry, New Relic, Dynatrace, Splunk, Zabbix and many more.
• Incident management: PagerDuty, OpsGenie, Grafana OnCall, Incident.io, Squadcast and others.
• Ticketing and chat: Jira, ServiceNow, GitHub, GitLab, Linear, Slack, Teams and Telegram.
• AI backends: Anthropic, OpenAI, Gemini, DeepSeek and local runners such as Ollama and LlamaCPP, used for correlation and summarization.

Deployment runs from Docker Compose locally to Kubernetes, AWS ECS and OpenShift, including air-gapped environments. Authentication covers SSO, SAML, OIDC and LDAP with role and attribute based access control, and the platform is documented as horizontally scalable for enterprise volumes.

OneUptime brings monitoring, alerting, incident response and observability into one application, so a team stops paying for a dozen products and stitching them together. It catches the outage, pages the right person, updates the status page and helps find the cause.

The platform maps directly onto the tools it displaces. Uptime monitoring covers website, API, ping, port, SSL, DNS and synthetic checks from probes around the world, while APM, metrics, log management and error tracking handle what happens once an alert has fired.

A single incident runs end to end inside the product.

• Detect: regional probes open an incident automatically when a threshold is crossed.
• Respond: on-call schedules and escalation policies call, text and push until someone acknowledges.
• Communicate: branded public and private status pages update themselves and notify subscribers by email and SMS.
• Diagnose: traces, logs and metrics correlate down to the individual span behind a slowdown.
• Auto-fix: an AI agent opens a pull request linked to the incident, verified against your configured build and test commands before you review it.

All of it is Apache 2.0 licensed. Self-hosting runs on a single Debian, Ubuntu or RHEL server with Docker and Docker Compose, cloning the release branch and filling a config file with your own strong secrets, and a Helm chart covers Kubernetes. A hosted cloud with a free tier funds the open source work for teams that would rather not operate it.

Wachd sits between monitoring and the person holding the pager. An alert from Grafana, Datadog, Splunk or any compatible source arrives as a webhook, and rather than a bare threshold breach the on-call engineer receives a diagnosis with a probable cause and a suggested action.

In between, the pipeline gathers recent commits, error logs and metric history around the alert time, strips identifying data from that context before anything analyzes it, correlates events into a causal timeline, and looks up who is on call. No agent runs in your clusters: alerts come in over HTTPS and Wachd calls your monitoring APIs outbound.

The deployment is shaped to stay inside your own boundary.

• Local analysis: Ollama is the default backend, so an air-gapped install makes no external calls, with OpenAI available instead.
• PII removal: a sanitizer strips identifying data with twenty-one patterns before analysis runs.
• Authentication: local users, OIDC sign-on against Entra, Okta or Google Workspace, group mappings and API tokens.
• On-call: a schedule and rotation engine decides who gets each notification over Slack and email.
• Storage: PostgreSQL holds the data and Redis carries the job queue between server and worker.

Server and worker are Go with a Next.js dashboard, deployable through Docker Compose on a single VPS or the bundled Helm chart on Kubernetes. First startup prints a generated superadmin password to the log, and the documentation is blunt that the shipped encryption key must be replaced before production. Apache 2.0 licensed.