microSRE — Linux metrics without the baggage

How it works

microSRE reads /proc directly — the same kernel interface that ps, top, and iostat use, but without the fragile parsing and version drift. It samples CPU, memory, disk I/O, and network counters, then diffs them to produce rates.

It also watches application logs you specify, matching each line against error patterns. When error volume crosses your threshold in a time window, it alerts. No SDK to install, no code to instrument, no vendor to depend on.

Alerts go to Slack, Discord, or Telegram. No dashboard, no agent, no vendor lock-in.

No root required. Runs as a regular user out of the box. Root unlocks per-process network details and a few extra signals — useful, but not required.

📊

CPU & memory

/proc/stat, /proc/meminfo, /proc/pressure

💾

Disk I/O

/proc/diskstats, space via statvfs

🌐

Network

/proc/net/dev, connection tracking

📜

App logs

Pattern match, rate threshold, alert

Why /proc directly

Standard tools are built for human eyes, not automation. Their output formats change between distributions, container environments break their assumptions, and combining multiple tools buries signal in noise.

Reading /proc directly gives you:

Stability — kernel ABI, not userland format strings
Speed — no fork/exec, no parsing overhead
Portability — works in minimal containers, rescue shells, locked-down hosts
Completeness — access fields that ps and top hide or misrepresent
Early warning - stay ahead of the OOM killer by monitoring /proc/pressure/mem, the same kernel triggers systemd uses to decide when processes die

Log scanning extends the same philosophy: observe applications from the outside, without modifying them. No SDK to break, no network dependency to fail, no vendor to disappear.

It's the observer that can't be blinded by the observed.

The dashboard problem

"We asked our team: when was the last time a dashboard helped you fix an incident?"

The answer was silence. Everyone looked at logs.

We had built dashboards for every new service — Prometheus, Grafana, the whole stack. Years later, not a single engineer on the team used them during an outage. They grepped logs, checked process state, traced what happened around the error. The dashboards were there because "that is what monitoring looks like," not because they solved problems.

microSRE is built for people who already know this. Alerts when something is wrong. The tools you already use to investigate. No graphs to scroll, no panels to configure, no compliance theater.

Across your fleet

When you have more than one machine, you need to know if the problem is local or widespread. The hosted view shows the same 60-second health check — CPU, memory, disk, network, pressure — for every server in one place. Like top for your whole infrastructure, not another dashboard builder. With a longer history and advanced alerting rules.

Private beta includes:

Dead man's switch - If a machine stops checking in, you know. No heartbeat means an alert, not a missing data point.
Only wake up for fires - Critical alerts page you immediately. Everything else batches into a digest or waits for business hours. Your on-call rotation will thank you.
One digest, not ten pings - Medium alerts collect into a single timed summary with full context. You scan the pattern in 3 seconds instead of muting the channel.
Alerts that tell you what to check - Every medium alert includes a one-line suggested command — iotop -o, tail -n 50. You fix problems, not dashboards.
Right noise, right room - Route critical alerts to #incidents with a ping. Send digests to #alerts silently. Your team stops training itself to ignore notifications.
Escalation without babysitting - If a medium alert persists, it automatically upgrades to critical after a timer you set. You don't need to watch the watcher.
Thresholds grounded in reality - Historic metrics show your actual baselines — CPU spikes during deploys, memory patterns overnight. Suggest better thresholds instead of guessing.