Coroot

Collecting metrics, logs and traces does not by itself make a system observable. Coroot gathers that data and turns it into findings, so an engineer reads a verdict rather than assembling one from a wall of dashboards.

Collection runs on eBPF, so metrics, logs, traces and profiles arrive with no code changes, including from legacy or third-party services nobody can instrument. The result is a service map covering the whole system, with predefined inspections auditing each application without configuration. Log search is backed by ClickHouse, and tracing stays vendor neutral through OpenTelemetry.

Coroot organizes what it finds into a few working views.

• Health summary: shows the status of hundreds of services at once and tracks service level objectives.
• Distributed tracing: opens any outlier request in a single click for investigation.
• Log patterns: cluster events out of the box and correlate logs with the traces behind them.
• Continuous profiling: attributes a CPU or memory spike to the precise line of code, compared against baseline behavior.
• Deployment tracking: discovers every rollout in a Kubernetes cluster and compares each release with the previous one, with no CI/CD integration.
• Cost monitoring: attributes AWS, GCP and Azure spend down to a specific application without access to your cloud account.

The project states that its built-in inspections identify over 80 percent of issues automatically, and an application missing its objectives triggers one alert carrying every relevant inspection. Coroot runs as a Docker container or in any Kubernetes cluster under the Apache 2.0 license, with an enterprise edition alongside.