Introduction
Coroot provides full-stack observability for microservice architectures without requiring manual instrumentation. It uses eBPF to collect metrics and traces at the kernel level, then correlates them with logs and profiles to deliver AI-assisted root cause analysis through pre-built dashboards.
What Coroot Does
- Auto-discovers services and builds a real-time dependency map using eBPF
- Collects RED metrics (Rate, Errors, Duration) without code changes
- Correlates metrics, logs, traces, and continuous profiles in a single view
- Provides SLO-based alerting with automatic anomaly detection
- Runs AI-powered root cause analysis to pinpoint failure sources
Architecture Overview
Coroot consists of a central server that ingests data from lightweight node agents deployed via DaemonSet. The node agent uses eBPF probes to capture TCP, HTTP, and database protocol traffic at the kernel level. The server stores time-series data in an embedded ClickHouse instance, builds service maps, and runs anomaly detection algorithms to generate root cause hypotheses.
Self-Hosting & Configuration
- Deploy the server as a single Docker container or Helm chart
- Install coroot-node-agent as a DaemonSet on each Kubernetes node
- Configure Prometheus remote write to ingest existing metrics
- Integrate with OpenTelemetry for distributed tracing data
- Set up SLO definitions and alert routing via the web UI
Key Features
- Zero-instrumentation setup: eBPF captures traffic without SDK changes
- Pre-built dashboards for CPU, memory, network, disk, and application metrics
- Continuous profiling for Go, Java, Python, Ruby, PHP, and .NET
- Log analysis with pattern detection and correlation to metric anomalies
- Cost monitoring for cloud infrastructure linked to service-level metrics
Comparison with Similar Tools
- Datadog — commercial SaaS with broad integrations; Coroot is self-hosted and open source
- Grafana + Prometheus — requires manual dashboard creation; Coroot provides pre-built views out of the box
- SigNoz — OpenTelemetry-native APM; Coroot adds eBPF auto-instrumentation and AI root cause analysis
- Pixie — eBPF-based observability by New Relic; Coroot is fully open source and self-hosted
- Netdata — focuses on infrastructure monitoring; Coroot adds application-level tracing and profiling
FAQ
Q: Does Coroot require code changes to my applications? A: No. The eBPF-based node agent captures metrics and traces at the kernel level without any SDK or library.
Q: What databases does Coroot monitor? A: Coroot automatically detects and monitors PostgreSQL, MySQL, Redis, MongoDB, Memcached, and Kafka at the protocol level.
Q: Can I use Coroot alongside Prometheus? A: Yes. Coroot accepts Prometheus remote write and can complement an existing Prometheus setup.
Q: How does the AI root cause analysis work? A: Coroot correlates anomalies across metrics, logs, and traces to identify the most likely failure cause, presenting ranked hypotheses in the UI.