From your telemetry to evidence you can check.
Epok owns the pipeline from logs, metrics, traces and real-user data to evidence items. Detectors produce observations with receipts and coverage: new failures, quiet services, host and node liveness, traffic and metric anomalies, latency breaks and capacity trends. Analysis uses that evidence to recognize incidents, investigate causes, recommend recovery and forecast trouble. Detection runs the same on every tier.
- An error you've never seen
Surfaces messages that never appeared in your recent history — the first sign of a fresh failure.
payment-service: "FATAL: connection pool exhausted" — first seen- A service gone quiet
Catches a service that stops logging when it normally logs steadily. Failure with no error — just absence.
worker-billing went silent — last log 6m ago (normally every 30s)- Spikes, drops, flatlines
Flags volume that jumps, falls, or flatlines against each service's daily and weekly normal.
api: 12,400 lines/min vs 3,200 normal (× 3.9)- Many errors, one pattern
Groups errors that share a shape, so dozens of variants land as a single alert.
84 variants of one failure folded into 1 alert- Crashing workloads
Surfaces crash loops, out-of-memory kills, and unschedulable workloads — from pod logs and events, correlated with host and container metrics.
billing-7c4b out-of-memory — 3rd restart in 4m- Failures that cascade
Produces evidence of upstream failures, retries and circuit-breaker trips, with dependency edges for analysis to check a cascade.
3 services blame one upstream — cascade in 8s- Metric anomalies & saturation
Watches CPU, memory, disk, and queue depth climb toward their limits, and flags any metric that breaks from its learned baseline.
checkout: memory 94% sustained 6m — saturation- A host or node gone dark
Marks a host, node, or agent down the moment it stops reporting — no heartbeat, no metrics, no logs. You page on the box, not just its symptoms downstream.
web-3 unreachable — 3 missed heartbeats, marked DOWN- Capacity, before it fills
Projects when a disk, volume, or quota will run out from its current trajectory — and pages with the ETA while you can still act, not after it breaks.
db-1 disk 92% — full in ~40m at current rate- Latency & tail-latency breaks
Flags when a service's p95/p99 latency breaks from normal — or its slow tail widens — from your trace spans, before the median moves.
payment p99 1.8s vs 320ms baseline — tail break
Evidence for your team and your agents.
Recovery recommendations start with the change and its blast radius while root-cause analysis continues. Runbooks and built-in playbooks supply reversible actions for known failure shapes. We recommend; you execute. Epok commits a cause only with supporting evidence; otherwise it says what is missing and what to check next. Follow evidence IDs to receipts and inspect coverage, including what was not seen, in the app, Slack and PagerDuty. Agents query the same evidence through the MCP agent gateway, with access on request.
- Service map
- New errors inbox
- Distributed traces
- Live tail + search
- Host map & service overview
- Fingerprint dedup
- Matching semantic fingerprints collapse into one alert with a fire count.
- Incident grouping
- Correlated signals can arrive as one incident with the chain attached.
- Dynamic suppression
- Repeat fires de-escalate on a widening window. New shapes get full severity.
- Severity rationing
- Critical / Warning / Info on explicit thresholds the product enforces.
Point your stack at Epok. Get evidence you can check.
Use open shippers — no proprietary Epok agent for server-side telemetry. Evaluate a representative production boundary for 14 days. Rule packs match supported inputs as they arrive; learned detectors use service history.