Early access
ZenLog collects, stores, searches and alerts on logs, metrics and traces in one product. It runs on your infrastructure and controls access down to individual streams, fields and rows.
Most observability stacks are several products glued together: one for logs, one for metrics, one for traces, each with its own storage, upgrades and access rules. SSO is common, but access stops at fixed roles. There's no fine-grained control over who can see which data.
Then there's volume. An ISP's network never stops logging: every CGNAT, BNG, OLT, RADIUS server and core router sends a constant flood of tiny records, millions a second, terabytes a day. With records that small, the cost is per record, not per byte. Each one is parsed, allocated and indexed on its own. Most of these stacks run on garbage-collected runtimes like the JVM or Go, so every record adds garbage, and every collection pause stalls ingest. Buffers fill, backpressure reaches the senders, and syslog over UDP drops records without a trace.
Writing fast is only half of it. You also need answers back from everything you've already stored, while ingest keeps running.
ZenLog is built to sustain high read and write demand at the same time. Writes take priority, so data keeps landing under load, and search stays fast across everything you've accumulated. Access is one model across every signal, down to individual fields and rows.
Collectors sit next to your sources and parse, redact, filter, sample and aggregate before data leaves the site. They buffer to local disk and ship in batches, so a network blip never loses data. The core receives records ready to store, and clients never reach ingest directly.
Every accepted record lands on disk in a fast queue before it's stored, so a slow moment in storage never reaches your senders.
Columnar storage compresses telemetry heavily and reads only the fields a query needs, so time-window searches, filters and aggregations stay fast as data piles up.
The gateway splits each query into chunks and runs them in parallel across query nodes, each reading its own shard of the data, with replicas standing by for failover. Reads and writes run in separate workload classes, so no query can starve ingest. New records become searchable moments after they arrive.
Every service is a native build optimized for its CPU architecture, using the instructions each machine offers.
Logs, metrics and traces are licensed separately. Start with logs and add the others when you're ready. Each answers its own question: logs say what happened, metrics show how much and how often, traces follow one request across services.
Signals connect through shared link keys: a trace ID, a service, a host, or your own, like a device name or an order ID. The collector aligns your data to those keys at the edge, so every link is an exact match, never a guess, and every lookup runs under the reader's own permissions.
Access is granted per data stream, and each grant can narrow what a reader sees with row filters, field visibility and masking, enforced inside the query so hidden data is never read. A NOC engineer gets the CGNAT records they need without the subscriber details they don't.
Every grant, change and query goes into a chained audit trail, so an edit or deletion can't go unnoticed.
Alerts with notification channels and acknowledgements, SLOs, dashboards, scheduled reports and exports, all on the same data and the same access rules.
Set retention per data stream and archive older data to any S3-compatible storage.
Use .deb packages from an apt repository, or container images with docker compose. Without internet access, install from a signed package bundle that includes every dependency, and license offline with a signed file, so nothing phones home.
Every release is signed with ed25519 and verified before it installs.
Every connection between services is encrypted with your own certificate authority, even inside your network, and your telemetry never leaves your infrastructure.
OIDC, SAML or LDAP, on the Enterprise licence.
Add shards and query nodes as volume grows, and every shard is replicated so a copy survives a node failure.
One component at a time, with a preflight check and a documented rollback.
Health, readiness and Prometheus metrics on every component, and ZenLog's own logs, metrics and traces searchable in ZenLog, with dashboards and alerts out of the box.
Written in Rust for memory safety and a smaller attack surface; passwords are stored with argon2id, with login lockout and strict security headers.
Pricing is by quote. Tell us what you run and roughly how much it sends, and we'll send you a price for your deployment.
ZenLog is in early access ahead of general release. If your network sends more logs than your current stack can keep up with, or you need tighter control over who sees what, write to us. Tell us what you run and roughly how much it sends, and we'll work out together whether ZenLog fits.