The five minutes before the crash, already on disk.

Most tools sample every 15, 30 or 60 seconds. When a machine dies, the last data point you have is from before anything went wrong, and everything interesting happened between two samples. You are left inferring a failure from an average.

Every machine keeps a rolling five-minute recording of its own state, one frame per second, held in memory. When risk crosses a threshold or a health check fails, that window is written to disk — 300 frames with no gaps, plus the process tree responsible.

The guilty process is chosen by sustained CPU rather than an instantaneous reading, so a brief spike does not get blamed for a gradual failure. Its parents are walked up to 32 levels at flush time, while those processes still exist. Dumps are kept for seven days, so you browse the crash rather than reconstruct it.