Kurage finds incidents, investigates them, and reports.
Kurage Zabbix is a monitoring system where Kurage — a local LLM — automatically investigates incidents detected by Zabbix. Evidence collection, log analysis, root-cause candidates with confidence levels, and recommended actions: the first hours of incident response, delivered as a report within minutes of detection.
How it works — fully automated, detection to report
Your existing Zabbix Server stays the source of truth. Incident events trigger the AI investigation pipeline via webhook.
Zabbix detects
Triggers, log monitoring (log/logrt) and SNMP traps watch 24/7. Incident events reach Kurage Zabbix via webhook.
Evidence collected
Raw events, related logs and metrics are pulled automatically from the Zabbix API — the primary evidence an investigator needs.
Kurage investigates
A local LLM (Gemma4 12B) reads the evidence and derives the summary, timeline, log analysis, root-cause candidates with confidence, and recommended actions. Confidential logs never reach external APIs.
Report delivered
The identical report goes to email and a private blog simultaneously, building a searchable knowledge base of every incident.
The 8-section investigation report
Every report follows the same structure — even at 3 a.m., you know exactly where to look.
Features
Works with your Zabbix
No monitoring migration. One webhook added to a running Zabbix Server 7.0 is all it takes.
Logs never leave the box
Investigation runs entirely on a local GPU with Gemma4. Incident logs and configuration details are never sent to cloud LLMs.
Incident knowledge accrues
Reports accumulate chronologically on an X-authenticated private blog — past incidents are always a search away.
Built on OSS
The blog is Bludit (MIT), vendored and pinned. A thin layer on top of proven OSS: Zabbix, rsyslog, Net-SNMP.