One engineer to enterprise fleets
RootTrace connects Linux health, traces, logs, deploys, and past incidents in one evidence trail. The same system can serve a single operator, several engineering teams, or a global fleet.
Follow your signal
One incident. Four moments.
RootTrace keeps each observation intact, then puts the useful relationships close enough to read. Quietly. Until the pattern snaps into focus.
Repeated samples for one check and resource accumulate on one issue. Different checks remain separate until an engineer links them.
Version changes, commits, host evidence, and trace errors share the incident timeline.
With enough traffic, RootTrace compares the hour before and after a version change and shows which endpoint and span type became slower or busier.
Elasticsearch can recall similar resolved incidents. Recommendations remain read-only, and the linked record becomes a Markdown or PDF postmortem draft.
Platform, SRE, and application teams
RootTrace reduces regrouping, timeline reconstruction, deploy comparison, and report assembly. The first figure is a published estimate of the work at stake. The rest describe shipped product behavior.
Follow the failure downward
Host diagnostics, APM, profiles, and database evidence meet under the same service and environment. The joins are the product.
Deploys, schema migrations, configuration changes, feature flags, and custom CI events land on the timeline. Eligible regressions name the endpoint and span type that became slower, busier, or both.
Change tracking →Outbound HTTP telemetry maps internal and third-party dependencies with request volume, latency, and failures.
PostgreSQL and MySQL/MariaDB query shapes sort by total time, calls, mean time, or rows. Bind parameters are removed, then redacted again before storage.
SELECT … FROM orders41.8%
UPDATE inventory …23.1%
INSERT INTO audit …8.6%
Raw, known-time, and adjusted availability stay separate. Confidence shows how much of the window was actually measured.
Linux, systemd, Docker, Kubernetes, AWS, databases, web servers, queues, HTTP, TLS, DNS, ping, browser journeys, and auditd. A custom Python check joins the same thresholds, issues, dashboards, and incident context.
Every issue gets investigation guidance. External AI is optional; a deterministic local path remains. Approval records a decision. It never runs a command.
Route lifecycle events to Slack, PagerDuty, Teams, email, or a webhook. Draft the review from the evidence already linked.
Application performance monitoring
Every transaction updates latency, throughput, error rate, and span time. RootTrace keeps the slowest waterfalls and groups repeat exceptions by fingerprint.
/api/collectors/heartbeat
200
POST /…/heartbeatreq255.2 ms
find collector_tokensdb2.0 ms
find roottrace.collectorsdb177.6 ms
update collector_tokensdb7.4 ms
aggregate hosts ×2db10.4 ms
insert audit_eventsdb4.9 ms
Spans cover 87% of this request.
Slowest: find roottrace.collectors · 177.6 ms.
From sampled traces: the slowest requests each flush, not total traffic.
RootTrace467 sampled · max 1543.0 ms
196.3 ms avgSafari76 sampled · max 2107.7 ms
749.6 ms avgRepeated exceptions settle into one fingerprinted group.
ServerSelectionTimeoutErrorcheckout-api · db.orders.find()
×1,283Grouped by exception type, culprit, and innermost stack frames.
Self-hosted
The API, Flutter dashboard, MongoDB, and optional Elasticsearch run on your infrastructure. License verification happens locally.
Collector traffic is outbound HTTP/S. SMTP, webhooks, VCS, and external AI create other egress only when you configure them.
Logs · SLOs · synthetics · dashboards
RootTrace carries the signals around a failure, then keeps their links intact: the log opens the trace, the SLO names the burn, and the synthetic runs from your collector.
Search logs, chart volume by level, alert on a match, and move between a log line and its trace.
Logging paths →Set latency, error-rate, or availability objectives. Multi-window burn alerts fire while the budget can still be saved.
Run HTTP, DNS, ping, browser-journey, secret-expiry, and vendor-status checks from infrastructure you control.
Check reference →Chart collected metrics from dropdowns, inspect real histogram percentiles, and save the current view to a dashboard.
Dashboard guide →Continuous profiling
CPU and wall-clock profiles remain separate. RootTrace ranks self time, turns CPU samples into a capacity estimate, and compares profiles around a deploy.
Illustrative CPU profile
0.5 average vCPU×730 hours=365 vCPU-hours per month
Security signals
/bin/sh
checkout-api · v4.12.0
Client, from trace203.0.113.47
Reported by host10.20.0.14
trace e07c42b6…
execve /bin/sh
auditd · uid 1001 www-data · within 15 minutes
Runtime security evidence
Python reports process spawning and unsafe deserialization inside requests; Node reports process spawning. Java, Go, and PHP can mark the same call sites explicitly. Repeated reports group into one finding with request and release context attached.
Also watched: persistent unfamiliar CPU call stacks and unexpected profiling silence.
RootTrace does not block calls, capture request bodies or command arguments, or execute a response.
Production audit evidence. Search nearby Linux activity by actor, host, executable, syscall, and outcome. Export evidence mapped to NIST, CMMC, DISA, and ISO controls; the report states what remains your responsibility.
Choose where it runs
The local quickstart uses two containers. No vendor account, card, DNS name, certificate, or license key. Hosted starts with the same Free limits.
docker pull public.ecr.aws/byteaffinity/roottrace/server:latest
This command only downloads the image. The quickstart supplies Compose and creates a bootstrap token. The first pull is nearly 6 GB; when it opens, you create one local owner.
Open the three-command quickstartCreate a cloud workspace, add a collector or APM SDK, and use the same dashboard. The Free plan covers one user, 3 hosts, and 3 APM services.
Create a free workspace No card required.Pricing
The same plans apply to hosted and licensed self-hosted deployments. Start free, then choose a plan inside the workspace. Span volume and busy release days do not move the bill. Logs, continuous profiling, database query monitoring and compliance evidence are part of the plan rather than separate meters.
Choose a starting footprint
Pick the closest size. Plans can change as your fleet grows.
25 hosts, 15 APM services, 5 users, and 90 days of retention.
Start freeFree
$0forever
Team
$149/ month
Startup
$449/ month
Enterprise
For fleets beyond the standard plans, custom licenses set the users, hosts, APM services, environments, integrations, and retention you need. Hosted or self-hosted.
SSO, SCIM, IP allowlists, service accounts, SIEM audit export, high availability, and air-gapped deployment.
Plan an enterprise deploymentGrowth covers 100 hosts for $1,299/month and Scale covers 500 for $3,499/month. Every tier is also available as a self-hosted licence at 20% less, because you supply the hardware. Deploying another application costs $8 to $12 a month. Sending more data from the ones you already have costs nothing. Compare the plans ↓
| Plan | Hosted | Self-hosted | Users | Hosts | APM services | Each additional | Environments | Integrations | Retention |
|---|---|---|---|---|---|---|---|---|---|
| Free | $0 | $0 | 1 | 3 | 3 | n/a | 1 | 1 | 14 days |
| Team | $149 | $119 | 3 | 10 | 5 | $12/mo | Unlimited | Unlimited | 30 days |
| Startup | $449 | $359 | 5 | 25 | 15 | $12/mo | Unlimited | Unlimited | 90 days |
| Growth | $1,299 | $1,039 | 25 | 100 | 50 | $10/mo | Unlimited | Unlimited | 365 days |
| Scale | $3,499 | $2,799 | 50 | 500 | 200 | $8/mo | Unlimited | Unlimited | 365 days |
From engineering
Architecture · 8 min
What the collector reads, writes locally, and can never execute.
Read the note →
Measurement · 7 min
Why unknown time and transient failures need their own states.
Read the note →
Incidents · 6 min
The exact grouping key, and where RootTrace deliberately stops.
Read the note →FAQ
For deployment and security specifics, the documentation is the source of truth.
Read the documentation →It can collect infrastructure, application, log, and reliability data itself, or run beside an existing stack. Its main job is to connect checks, traces, deploys, incident history, and the final postmortem.
No. The collector has no remediation executor and accepts no inbound commands. It reports to the API URL you configure. Recommendations remain suggestions for an engineer to review.
Python 3.9+ and Node 18+ are published packages. Go 1.21+, Java 11+, and PHP 8.1+ are available as source implementations. OTLP JSON and protobuf work over HTTP; OTLP gRPC is unsupported.
Hosted: one user, 3 hosts, 3 APM services, 1 environment, 1 integration, and 14 days of retention. An unlicensed self-hosted installation runs on 5 hosts with 1 day of retention, on your own storage.
The local stack starts in about a minute after the first image download. That image is nearly 6 GB. The production Docker Compose installation is designed for about 30 minutes.
Paid hosted and self-hosted workspaces support OIDC, SAML 2.0, or LDAP, SSO-required mode, group-to-role mapping, and organization-scoped SCIM 2.0 user lifecycle. SSO authenticates existing users; SCIM provisions and deactivates them.
No. Linux audit evidence can be mapped into reports for NIST SP 800-171 Rev. 3, CMMC, DISA STIG/SRG, and ISO/IEC 27001:2022. The report shows captured evidence and remaining responsibilities. It does not certify the organization.
Start with one operator. Scale across the organization.