From alert to root cause to fix, in minutes.
When an alert fires, Ketl reads your logs, traces, deploys and past incidents, names the likely cause in plain language, and proposes the exact fix or rollback. No more hour of blind digging at 3am.
An hour of blind digging
The fix is rarely the hard part. Finding out what to fix is. The signal that explains an outage is real, but it is scattered across tools that were never meant to be read together, at the hour you are least able to read them.
Most of an incident is not the fix. It is the digging: reading logs, scrubbing dashboards, and guessing which of six tools holds the thread.
Logs here, traces there, the deploy feed, the runbook, last month's incident, and the alert itself. The context is scattered at the worst possible moment.
On-call load lands when you are least able to reason, and the engineer paged is rarely the one who wrote the code that broke.
Connect once, then let it read every alert
Three steps. No new agent to run, no data to move, and read-only by default. Ketl does the reading and the correlating; you keep the judgment and the action.
- step 01
Connect your telemetry
Point Ketl at the places your signal already lives: logs, traces, recent deploys, and your past incidents. No new agent to run, no data to move. Read-only by default.
ketlketl connect datadog pagerduty github sentry - step 02
Ketl reads and reasons at each alert
The moment an alert fires, Ketl pulls the relevant window across every signal and reasons about cause the way a senior on-call would, in seconds rather than an hour.
ketlalert → reading 2,140 log lines · 3 deploys · 11 traces - step 03
You get root cause plus a proposed fix
A ranked root cause, each with the exact lines Ketl reasoned from, and one concrete next step: a fix or a rollback, with the command and the risk. You decide, then act.
ketlcause: N+1 from v2.48.0 · fix: rollback → v2.47.3
A real alert, read and resolved
Pick an incident and step through what Ketl returns: the ranked cause, the exact evidence behind it, and the fix. This runs entirely in your browser. The live engine returns the same shape from your own telemetry.
[PagerDuty] checkout-api: error rate 4.8% (threshold 1%) and p99 2410ms on POST /checkout. Triggered 14:05 UTC.
14:02:11 checkout-api INFO deploy v2.48.0 rolled out to 100% (build 8a3f21c) 14:04:36 checkout-api WARN db.query duration=1180ms query="SELECT * FROM line_items WHERE order_id = $1" rows=1 14:04:36 checkout-api WARN db.query duration=1204ms query="SELECT * FROM line_items WHERE order_id = $1" rows=1 14:04:37 checkout-api WARN db.query duration=1173ms query="SELECT * FROM line_items WHERE order_id = $1" rows=1 14:05:02 checkout-api ERROR upstream timeout after 2000ms route=POST /checkout trace=8f2c9d1a 14:05:03 checkout-api ERROR 503 Service Unavailable route=POST /checkout p99=2410ms 14:05:09 postgres LOG duration: 1190.221 ms statement: SELECT * FROM line_items WHERE order_id = $1 14:05:20 checkout-api WARN pool: 20/20 connections in use, 34 waiting
The 14:02 deploy replaced a batched cart load with a per-item query, creating an N+1 against Postgres. Query latency climbed past a second, the connection pool saturated at 20/20, and checkout began timing out and returning 503s.
N+1 query introduced by v2.48.0 (cart serializer change)
PR #4821 switched the cart serializer to a per-item line lookup, so each order now issues one SELECT per line item instead of a single batched query. The identical query repeating at about 1.2s each is the N+1, and it lands right after the 14:02 rollout.
Connection pool exhaustion as a downstream effect
The slow queries hold connections long enough that the pool fills to 20/20 with 34 requests waiting. This is a symptom of the N+1, not a separate cause, but it is what turns slow requests into 503s.
A copilot that reads everything, then shows its work
Reads every signal, together
Logs, traces, recent deploys and past incidents, read as one picture. Cause usually lives in the seam between two signals, which is exactly where a single dashboard cannot look.
Root cause in plain language
Not an anomaly score. A sentence a tired engineer can act on, ranked by how strongly the evidence supports it, with an honest confidence on each.
A proposed fix or rollback
One concrete next step, with the exact command, the blast radius, and how to confirm it worked. You stay in control; Ketl does the digging.
Evidence you can check
Every cause cites the exact log lines, deploy, or past incident behind it, quoted verbatim. Ketl shows its work, so you trust it or overrule it in seconds.
Model-agnostic routing
Ketl routes each step across frontier and open models, sending hard cross-signal reasoning to a strong model and cheap triage to a fast one. No single lab to bet the pager on.
Fits your stack
PagerDuty, Datadog, Grafana, Sentry, GitHub and Slack out of the box. The diagnosis lands where you already are, seconds after the page.
This product does not exist without modern AI
Telemetry is messy, unstructured, and different at every company. Reading it and reasoning about cause is language work, and only recent models are good enough to do it under pressure. That reasoning is the engine of Ketl, not a feature bolted onto a dashboard.
Language models are the engine
The core action, reading raw logs and traces and naming a cause, is model reasoning. There is no rules engine underneath pretending to be smart.
Model-agnostic by design
Ketl keeps a registry of frontier and open models and routes each step to the one that clears the bar for the least cost. Labs move fast; the router moves with them.
Evidence-grounded, not hand-wavy
Every claim is tied to a quoted line from your telemetry. The model reasons; the evidence keeps it honest, and keeps you in control.
Classify severity, group duplicate alerts, and decide whether this needs a full diagnosis. Cheap and fast.
Read logs, traces, recent deploys and past incidents together and reason about the likely cause. The heaviest step, sent to a frontier model.
Order candidate causes by how well the evidence supports them and attach a confidence to each.
Turn the leading cause into a concrete fix or rollback, with the exact steps and a stated risk.
The engineers who get paged
The first read named the bad deploy before I finished opening my dashboards. We rolled back in four minutes instead of forty, at 3am, half awake.
It reads logs the way our most senior on-call does, and it shows the exact lines it reasoned from. The evidence is the part that got the team to trust it.
Priced to your currency
Start free with no card. Team is the plan most rotations buy. Scale runs on your ground. Prices show in your local currency.
Free
For one on-call engineer
Paste an alert and its logs, get a ranked root cause with cited evidence and a proposed fix. Everything the paid plans do, at a small monthly volume.
Start free- Ranked root cause with cited evidence
- Proposed fix or rollback with steps
- Model-agnostic routing across models
- One personal workspace
- Paste-in logs, deploys and past incidents
- Community support
For an engineer who wants to feel the difference on their next page.
Team
For a team that shares an on-call
Connect your telemetry so Ketl reads it automatically the moment an alert fires. A shared workspace, integrations, and the volume a real rotation needs.
Start Team- Everything in Free, at team volume
- Connect PagerDuty, Datadog, Grafana
- Read from GitHub deploys and Sentry
- Shared workspace and incident history
- Post the diagnosis to Slack on page
- Priority routing to frontier models
- Email support with a one-day reply
For a team replacing an hour of blind digging with a first read in seconds.
Scale
For security-first organizations
Ketl on your ground. Single sign-on, self-host or run in your own cloud, dedicated model capacity, an audit log, and a security review to match procurement.
Contact sales- Everything in Team, without limits
- SSO and SCIM, audit log
- Self-host or run in your VPC
- Route to open models you host
- Data residency and retention controls
- Dedicated support and an SLA
- Security review, DPA, procurement
For regulated and security-first teams that keep telemetry in-house.
Prices show in your local currency, converted from the USD home price at a fixed rate. Sales tax is added where it applies. The Free tier is genuinely free and needs no card.
Before you connect anything
From alert to root cause to fix.
Start free, no card, and run a real diagnosis on your next page. Or connect your stack and watch Ketl fire the moment an alert does.