Auto-recovery before the page fires. Anomaly detection before the threshold catches up. Postmortems with the evidence already attached. A signed audit trail you can actually defend. The serious parts of the SRE job — built in, not bolted on, not three SaaS subscriptions duct-taped together.
php-fpm exit · signal 11systemctl restart php-fpmWe’ve carried pagers. The list looks the same everywhere. HostAtlas is built around exactly this list.
A worker crashes. A connection pool exhausts. PHP-FPM gets a SIGSEGV. The playbook is three steps and you’re back. Auto-Recovery runs those three steps within seconds, bounded by per-service limits. The page only fires if the loop trips the limit.
On-host log rotation runs in minutes. The lines from just before the crash are the ones you need, and they’re usually gone by the time you SSH in. The platform keeps a rolling pre-fire buffer per host so the lines are already attached to the incident when it opens.
A database hiccup pages CPU on the API, p95 on the load balancer and queue-depth on the worker pool. AI Triage recognises the dependency chain and groups them into one incident with a root-cause hypothesis — not three separate "what now" tickets.
That reconstruction takes hours and goes in a Notion page that nobody reads. HostAtlas keeps a signed, chronological record of every event — alert, deploy, restart, comment, command — and exports it as a draft postmortem the moment the incident resolves.
Not 50 dashboard widgets. Five tools that you reach for during an incident and a quiet Monday morning equally.
Per-service policies: manual, auto_once, auto_limited. The agent acts on its own host (no SSH round-trip), runs the matching systemctl unit, observes recovery, records the action. If the loop trips its limit, then the page fires — with the full restart history attached.
Smart Alerts add the boring things that turn a noisy alert into a useful one: durations, anti-flapping hysteresis, include / exclude target selectors, composite rules across sources. Anomaly Detection layers statistical baselines per metric on top — z-score severity, classified automatically.
Real-world effect: the rule "page when 5xx rate > baseline + 3σ for 90 seconds on hosts tagged env:prod AND not under maintenance" is two clicks to build and stops paging on every 30-second blip.
An incident opens when its first alert fires. Pre-fire logs (rolling 5 / 15 / 30 minute buffer, plan-dependent), the matching metric chart, recent deploys, recent recipe runs — all attached at t = 0. Ownership, severity, status, comms thread, Slack channel (auto-created on Pro) all live on the same page.
Five alerts firing across three hosts collapse into one incident with a root-cause hypothesis, ranked by impact. Severity is scored from downstream effect, not metric thresholds — CPU spiking alone doesn’t outrank queue backlog rising at the same time.
The model has access to the metrics, the logs (redacted), the recent changes — nothing else. Every output cites the evidence it grounded on. Per-tenant choice of managed or self-hosted model.
Every action — UI click, API call, MCP tool call, agent action — lands in one tenant-wide audit log. HMAC-SHA256 chain, each entry signed including the hash of the previous. A modification anywhere in the chain produces a verification mismatch instantly.
Auditors stop asking "how do you know nothing was deleted?" because the answer is a green / red badge in the UI. Export to your own object store for retention beyond plan limits.
Live cross-host dependency graph, built from the connections the agent already observes — no YAML to maintain, no diagrams to redraw. During an incident, "what else does db-prod-01 serve?" is a click, not a tribal-knowledge poll.
Anatomy of one mid-night incident from agent event to closed postmortem. Real cadence, real shape, no nobody-was-paged.
php-fpm on api-prod exits with signal 11. Agent observes via systemd dbus subscription. auto_limited · max 3 / hour · cooldown 10 min. Within budget; proceed. systemctl restart php-fpm. Polkit policy permits; sudo not required. warn; no page. Most teams arrive with PagerDuty + Datadog + Grafana + a Notion runbook. HostAtlas doesn’t replace each of those individually — it removes the seams between them.
Free tier covers a single server forever. Install the agent on the box that gets the most pages. Watch what gets auto-discovered.
Install guide →Pick the one that keeps waking you up. Start with auto_once. Watch it act, watch the audit log, watch the cooldown. Then escalate.
Once one host behaves, add the env:prod tag selector to your recovery rule and let the policy follow your fleet around as it grows.
Free tier covers a single server forever. Pro is where the recipe library and AI features unlock.