Your network and its logs, correlated on one graph.
GridNMS unifies device metrics, logs, and topology. When something breaks you see the cause and everything it affects, not a wall of disconnected alerts.
From $49/month. Cloud-hosted, or self-hosted with Docker.
Metrics that read at a glance.
Pick a device and a time window. GridNMS returns per-interface traffic, packets, and errors with per-second rates already computed, next to the device's system health. The math runs server-side, so the charts come back ready to read.
Find every host, and everything it exposes.
Point GridNMS at your networks. It sweeps for live hosts, fingerprints the TCP and UDP services each one runs, and maps the result onto the graph. A new device on the wire shows up with its open ports and slots into your topology on its own.
- Scan profiles from light touch to thorough, with port scanning.
- Hosts and the ports they expose, modeled as graph relationships.
- Promote a discovered host to a fully monitored device in one step.
See the blast radius before you act.
GridNMS keeps a living model of your topology: who connects to whom, and who depends on it. When a device fails, the upstream root cause and every affected downstream device are right there, so you fix the problem instead of chasing symptoms.
- Links discovered automatically from LLDP and CDP neighbor data.
- Dependency and impact analysis across the whole topology.
- Layouts and filters by class, layer, site, and status.
One detection language for logs and metrics.
Write detections in YARA-L and run them across your logs and your telemetry alike, either on a schedule for coverage, or streaming at ingest for instant signal. Every hit becomes an event with a clear severity, deduplicated and closed automatically on recovery.
- Hybrid engine: scheduled windows plus real-time streaming.
- Field extraction turns raw logs into searchable fields.
- Built-in rules to start; fully editable for your environment.
rule wan_uplink_saturation { meta: source = "metric" severity = "major" events: $m.metric = "in_bps" $m.value > 0.9 * $m.capacity condition: $m over 5m }
One alert sent, with full context. Not twelve pages.
Alerts that group themselves.
A storm of related or flapping events shouldn't mean a storm of pages. Case rules correlate them into a single case over a window you define, so you get one alert with the full picture, then a workbench to investigate and resolve it.
- Correlate by device, detection, severity, and site.
- Flap suppression so a value on the edge doesn't double-fire.
- Cases close on their own once the noise settles.
More capabilities
Agent-less collection
No per-device agents to install or maintain. One lightweight collector speaks SNMP, SSH, ICMP, syslog, and SNMP traps to your gear, and connects outbound only.
Fully customizable
Define what gets collected with monitoring packs, organize devices into classes, build the dashboards you want, and route alerts to email, Slack, webhooks, or PagerDuty.
Interface thresholds
Set per-interface limits on traffic, errors, or utilization. A breach opens an event on its own, and clears itself when the interface recovers.
How it works
Collection runs inside your network. Correlation, detection, and alerting run in GridNMS.
Discover & collect
A collector scans for hosts and services, polls SNMP/SSH/ICMP, and receives syslog and traps.
Correlate
Metrics, logs, and topology come together: devices mapped onto a live graph with their dependencies.
Detect
YARA-L detections and interface thresholds turn signal into prioritized events across logs and metrics.
Resolve
Events group into cases and alert once, to email, Slack, webhooks, or PagerDuty.
Live in one sitting.
A guided Deployment Checklist takes you from an empty account to a fully monitored network with alerting — the moment you sign in. No guessing what to do next.
- Self-verifying. Each step ticks itself off once GridNMS confirms it's actually done — not just when you click.
- Every step deep-links to the exact page that satisfies it, so you're always one click from the next action.
- Same path everywhere — identical on GridNMS Cloud and self-hosted. Dismiss it any time and reopen it from the dashboard.
Pricing
Plans start at $49 per month. Run GridNMS in our cloud, or self-host it with Docker.
Evaluating alternatives? See how GridNMS compares to SolarWinds and Auvik.
Cloud
Fully managed. We run it; you monitor.
- Graph correlation and impact analysis
- Host and service discovery
- YARA-L detections on logs and metrics
- Automatic case management and alerting
- Managed TLS, storage, and retention
Self-hosted
Run the same platform on your own infrastructure.
- The full GridNMS feature set
- One-command Docker install
- Your data stays on your hardware
- Bring your own TLS certificate
See your network as one system.
Every device, metric, and log on one graph. From $49/month.