Alfred

Alfred is a monitoring platform for a fleet of servers and workstations — the kind of coverage companies like Datadog and New Relic charge by the host for. I built it to get the same visibility without per-agent pricing, and because most commercial tools make you fight their UI to write an alert that actually understands your infrastructure.

A small Go agent runs on each machine and pushes CPU, memory, disk, network and service status to a central server every 15–30 seconds. Anything that can't run an agent — a NAS, a switch, a third-party API — gets checked agentlessly instead: HTTP, TCP, ICMP ping, SMB directory counts, even direct SQL Server queries. Everything lands in TimescaleDB, so months of history stay queryable without the database falling over.

The part I spent the most time on is the rules engine. Alerts are written as expressions against real fields — disk.min_free_pct, mem.percent, net.err_in — not a dropdown of preset thresholds, with an optional sustained-duration window so a five-second spike doesn't page anyone at 3am. Rules evaluate live over Server-Sent Events, so an incident appears on the dashboard the moment it trips — including on the wall view, a drag-and-drop layout designer for arranging servers into sections on an actual NOC screen.

It handles the operational stuff a monitoring tool needs to be trusted with something real: encrypted credential storage for every SQL/SMB connection it touches, an audit log, Azure AD single sign-on, and agents that ship their own update mechanism so a fleet doesn't need manual upgrades. It's open source and still under active development.