Draw your architecture on a canvas, then watch health arrive on the nodes you drew — on-prem firewalls to cloud microservices, with real-time metrics, AI-read logs and alerting, all in one place.
How the AI works: log analysis, incident explanation, alert correlation →
Built by the people who run the system, brought in from what you already have, and drawn for the process as well as the servers.
From firewall rules to Kubernetes pods.
Simulated monitoring of a hybrid on-prem + cloud deployment
60+ data sources across cloud, infrastructure, security & data — every one with a step-by-step setup guide
RECAP reads the noise out of your logs. It clusters, scores, and root-causes raw ERROR streams into a short, ranked feed of incidents — each with an automated RCA — so on-call sees what broke and why instead of a wall of stack traces.
Designed to plug straight into Topologix Log Sources — turning the logs you already collect into ranked, root-caused incidents.
Your pipelines register each change and the right people approve it. While it runs, Topologix holds the alerts for exactly what it touches, and afterwards it tells you, with evidence, whether it hurt.
From the UI, or from any CI/CD job that can reach your proxy. Read the change management guide →
Three simulated incidents, narrated end to end: in the cloud, on-prem and across both. Each one follows the monitoring bot as it gathers the evidence, read-only, until it can name the cause.
Black Friday, and checkout starts timing out while every dashboard stays green. The monitoring bot follows the evidence from the load balancer’s logs to a disk volume flat-lining at exactly 300 IOPS: its burst credits drained, night after night, by a neighbouring service whose log level was left on DEBUG.
Nine business apps freeze at random, and four teams each prove that their own layer is green. The bot lines every freeze up with vCenter placement — all 31 happened on host-07 — and a don’t-fragment ping finds two switch ports that a line-card swap reset to MTU 1500, silently dropping the jumbo storage frames.
One payment in three is slow, by exactly five seconds, while the cloud, the VPN and the core system all report healthy. The bot times every phase of the call and finds the delay in DNS: a domain controller decommissioned on-prem is still a resolver in the cloud, and half the lookups wait out its timeout.
Everything you need to know about Topologix
Topologix is a real-time infrastructure monitoring tool that lets you visualize your entire network — on-prem firewalls, routers, cloud services, databases, and Kubernetes clusters — as an interactive flow diagram with live metrics, health checks, AI-driven log analysis, and advanced alerting.
60+ integrations across seven categories. Cloud & CDN: Cloudflare, CloudFront. Monitoring & observability: Prometheus (custom PromQL), Zabbix, Dynatrace, SigNoz, Zipkin, Elastic APM, Graylog, Sentry, Status Page, JVM via JMX/Jolokia, and a generic REST/JSON API source. Infrastructure & networking: the AWS suite (EC2, ELB, RDS, S3, WAF, Shield), VMware vCenter & ESXi, Nutanix, Kubernetes, HPE Aruba (Central, AOS-CX, controllers, ClearPass), Active Directory, Microsoft 365, DNS, DHCP and file servers, TLS certificate probes, Server Vitals, HAProxy, SNMP, HPE iLO, Dell iDRAC, Lenovo XCC, H3C HDM, HPE Alletra, Dell EMC & PowerVault storage, Room Alert, Vutlan, MOXA ioLogik, Matter and Zigbee. Data & storage: PostgreSQL, MySQL/MariaDB, MSSQL, ClickHouse, Redis, Hazelcast, Apache NiFi, SSIS. Security: Fortinet, Palo Alto, Check Point, Cisco ISE. Analytics: Google Analytics 4, Firebase. Alerts route to Slack, Microsoft Teams, email, or any webhook — and the list keeps growing.
Topologix connects to a local LLM you run yourself (Ollama, vLLM, LM Studio, or any OpenAI-compatible endpoint). When a Graylog source detects an error spike, it automatically pulls up to 200 recent logs from the failing service and asks the model for a post-mortem — diagnosis, most likely cause, and a suggested fix — shown inline in the logs dialog with prompt/completion token counts. You can also trigger an analysis manually. On self-hosted deployments, logs never leave your network.
Every flow has a built-in chat bot: describe a symptom in plain language — 'checkout is slow since 14:00' — and it answers with a diagnosis grounded in that flow's live evidence: architecture and dependencies, current metric values, alerts, and recent changes. When it needs more, it queries your connected integrations itself — fetching current values, resolving RECAP incidents, pulling traces, and searching logs — and cites what it found. A Teach tab lets you store your environment's quirks so answers keep improving. It runs on the same local or cloud LLM you configure for log analysis.
Yes, in the practical sense of AI applied to IT operations. Topologix collects the data and computes the baselines and alert states itself; an AI model then reads log-error spikes and writes a post-mortem, the monitoring bot explains alerts, alert groups and incidents with evidence it gathers through read-only tools, and AI verdicts help decide whether problems that started together are one incident. The model is the one you configure: a cloud provider such as Anthropic, OpenAI, Azure OpenAI, AWS Bedrock or Google Gemini, or a self-hosted model on your own hardware. Self-host Topologix with a self-hosted model and nothing leaves your network.
Rule-based alerting with multiple trigger types: status transitions (ok↔error), consecutive failures, recovery (with downtime duration), and metric thresholds. Latency alarms track per-service breach state with auto-clearing after sustained clean ticks. Alerts carry the flow/node name, metric context, a trailing sparkline, and top-contributor breakdowns, and are delivered to Slack, Microsoft Teams, and email with deep links straight to the failing node.
Both. The hosted service is the fastest way to start — sign up and you are monitoring in minutes, with no installation. Prefer to run it yourself? Self-hosted deployment on your own infrastructure is fully supported: the application runs on Node.js and stores its data in either an embedded SQLite file or a PostgreSQL database you point it at — switchable from the admin panel, with a guided migration between the two. Self-host and no data leaves your network unless you connect cloud integrations like Cloudflare or Google Analytics.
Drag and drop nodes onto a canvas, connect them with edges, and attach metric sources and health checks to each node. You can also import existing diagrams from Microsoft Visio (.vsdx), draw.io/diagrams.net (XML), or generate a flow from a screenshot using AI-powered image analysis.
Yes. Topologix's distributed proxy agents run inside your private networks and route checks, metrics, and even discovery requests (like SNMP interface walks) back to the central server. Routers on management VLANs, databases behind NAT, air-gapped environments — all reachable.
The proxy agent polls the central server every 15 seconds for its assigned monitors and metric sources. It executes checks locally, computes SNMP counter rates in memory, and pushes results back every 5 seconds. The central server never needs to reach the target directly.
Topologix detects proxy failures within ~90 seconds. Affected metrics and health checks are visually marked as stale with an amber "Proxy offline" indicator, and the last known values are kept visible but grayed out so operators can still see the final reading.
Per-interface utilization (In/Out Mbps, utilization %, error rates) using 64-bit HC counters from IF-MIB. Supports SNMPv2c (community string) and SNMPv3 (authPriv with SHA/AES). The interface picker auto-discovers physical interfaces from the router via an SNMP walk.
30 presets across 8 categories: connections (active, idle-in-transaction, utilization %), throughput (TPS, deadlocks), efficiency (cache hit ratio, temp files), storage (database size, dead tuples, unused indexes), replication (lag), pg_stat_statements (top query times), background writer, and WAL stats.
Yes. Google Analytics 4 integration pulls 12 presets including real-time active users, sessions, pageviews, engagement rate, and bounce rate. Firebase integration covers Firestore read/write counts, Cloud Functions invocations/errors, Realtime Database connections, Hosting/Storage bandwidth, and Auth user counts.
JWT-based authentication with admin and user roles. Admins can create/delete users and reset passwords. Users can change their own password via the username dropdown menu (requires current password + confirmation). Service account tokens authenticate integrations.
All browser-to-server communication uses HTTPS. Connections to on-prem targets support TLS with an "Allow self-signed certificate" toggle. SNMP v3 supports AES encryption. Integration credentials are encrypted at rest — and on self-hosted deployments they live in your own database, the embedded SQLite file or your PostgreSQL instance, on infrastructure you control.