Agent Overview

The Vorniq agent is a lightweight Go binary that runs on your server, watches log files for known error patterns, and reports incidents to your dashboard in real time.

How it works

Server logs  →  Agent  →  Vorniq API  →  Dashboard  →  AI analysis

1. On startup — the agent authenticates with your agent key and fetches its configuration from the dashboard.
2. Every few seconds — it reads new bytes from each watched log file and runs them through detection rules.
3. On a match — it sends an incident to the API with the title, severity level, and the raw log line that triggered it.
4. Every 5 minutes — it re-fetches its config so any changes you make in the dashboard take effect without a restart.

What it monitors

The agent detects incidents across six built-in categories:

Category	Examples
nginx	Upstream failures, SSL errors, 502/503/504 responses
php	PHP-FPM crashes, fatal errors, warnings
laravel	Application errors and critical exceptions
docker	Container deaths, OOM kills, unhealthy containers
auth	SSH brute-force, invalid user attempts
system	Disk full, OOM killer, filesystem errors

You can enable or disable any category from the dashboard. See Monitoring Rules for the full list.

Requirements

• Linux x86_64, Linux ARM64, or macOS (Apple Silicon or Intel)
• systemd for running as a service (recommended)
• Read access to your log files
• Outbound HTTPS to api.vorniq.cc

No runtime required — the agent is a single static binary.