Usage

Long-running

Continuous deployments that observe a system over its lifetime.

Run the agent and scrape with Prometheus

Standard always-on monitoring. The agent collects via eBPF and exposes its data to the exporter, which serves Prometheus on :4242.

# systemd-installed: both services are already enabled

$sudo systemctl start rezolus rezolus-exporter

# Point Prometheus at :4242 and wire Grafana to that source

Keep a rolling buffer with Hindsight

For systems where you can't predict when something will go wrong. Hindsight maintains a rolling on-disk ring buffer of high-resolution snapshots; when an incident hits, trigger a snapshot and load the surrounding time window in the viewer.

$sudo systemctl start rezolus-hindsight

# Trigger a snapshot on demand (signal or HTTP)

$sudo pkill -HUP -f rezolus-hindsight

# Or via the HTTP API for scripted triggers

$curl -X POST http://localhost:4243/snapshot

Combine your own metrics

Pull metrics from your application's OpenTelemetry/Prometheus endpoint into the same recording as the rezolus system metrics. Useful for correlating service-level KPIs (request rate, p99 latency) with kernel-level events.

rezolus-record.toml

[recording]

interval = "1s"

output = "combined.parquet"

[[endpoints]] # rezolus agent

url = "http://127.0.0.1:4241"

source = "rezolus"

[[endpoints]] # your service's /metrics

url = "http://127.0.0.1:9090/metrics"

source = "my-service"

role = "service"

protocol = "prometheus"

$rezolus record --config rezolus-record.toml

One-off

Ad-hoc captures and live connections for a specific investigation.

Capture a recording for performance analysis

Run a workload while recording at a high enough resolution to catch what you're looking for. The output parquet is self-contained — open it later, share it, archive it.

# Record 60s at 100ms intervals against a running agent

$rezolus record -i 100ms -d 60s http://localhost:4241 run-1.parquet

# Open it in the viewer

$rezolus view run-1.parquet

A/B comparison

Compare two recordings side-by-side — before/after a change, baseline vs. experiment, or two different machines. The viewer renders each chart twice and surfaces deltas.

$rezolus view baseline.parquet experiment.parquet

# Aliases for clearer labels in the UI

$rezolus view before=run-a.parquet after=run-b.parquet

Live-tail a remote agent

Skip the recording step and stream straight from an agent into a browser dashboard. Best for quick checks against a remote host where you don't want to save anything to disk.

$rezolus view http://agent-host:4241

Offline analysis

Things you do after the data is already captured — in the viewer or via the MCP server.

A/B comparison

Same workflow as in the one-off case: any two recordings can be compared, regardless of when or how they were captured. Useful when you already have an archive of runs and want to spot regressions between specific pairs.

$rezolus view 2025-12-01.parquet 2026-01-15.parquet

Per-cgroup / container drill-down

CPU, Scheduler, and Syscall samplers emit per-cgroup metrics. In the viewer, switch the cgroup selector to a specific container to see only its CPU usage, runqueue latency, syscall mix — isolating one tenant on a noisy host.

$rezolus view recording.parquet

# In the viewer: Cgroups section → pick a container → all charts re-scope

AI-assisted analysis with MCP

Point the MCP server at a recording and ask an LLM-driven client to investigate. Built-in tools cover anomaly detection (MAD / CUSUM / FFT), metric correlation, and arbitrary PromQL queries against the recording.

# One-shot CLI mode

$rezolus mcp detect-anomalies recording.parquet

# Or run as a stdio server for Claude Desktop / Cursor

$rezolus mcp

← Installation Architecture →