Risk engine
Turns nine separate measurements into one number a human can act on.
Traditional monitoring asks yes-or-no questions. Is the disk above 90%? Is the endpoint returning 200? Each answer is useless on its own, because a server can be perfectly healthy at 91% disk and about to fall over at 60%.
The risk engine asks a different question: taken together, how close is this machine to trouble? It samples nine classes of signal — scheduling delays, memory pressure, failed system calls, network retries, disk saturation and others — and fuses them into a single score from 0 to 100.
Three floors matter. At 35 the machine is worth watching. At 60 something is genuinely wrong and the engine starts building an evidence trail. At 82 the incident opens on its own, with the evidence already attached. Because the score is continuous rather than binary, it also carries an estimate of how long you have before failure.
The nine signal classes
- 01
Scheduling delay
How long work waits for a free CPU, and which tasks keep losing their turn
- 02
Memory pressure
Reclaim activity and how hard the machine is working to free memory
- 03
Failed operations
System calls returning errors, grouped by what kind of failure
- 04
Network retries
Connections retransmitting quietly, long before a timeout surfaces
- 05
Disk saturation
Real device queue depth, including volumes with no mounted filesystem
- 06
Capacity limits
File handles, process slots and container limits approaching their ceiling
- 07
Response latency
Request timing drifting outside what this endpoint learned as normal
- 08
Container churn
Restarts, evictions and cluster events clustered in a short window
- 09
Behavioural drift
Today compared against this machine’s own four-week baseline
At a glance
- runs
- every 20 seconds
- signals fused
- 9 classes
- floors
- 35 / 60 / 82
- output
- 0–100 plus a horizon
All six engines run on every plan with agents.
Install on one machine and the first score lands 20 seconds later.
Deploy an agent→