LogClip

The platform

One console for every layer of experience.

Replay, heatmaps, funnels, AI, vitals, uptime, traces, logs and hosts — every one of them reads from the same visit, on the same timeline. A failed click in the player is a step in the funnel, a card in the insights, a span on the server.

0:000:100:200:30
Replay
//jackets
Network
Funnels
add_to_cart ✕
App Monitor
Infrastructure
db-01 · memory 98%
One visit, all the way down

A click that failed, and the outage behind it.

A real visit to a storefront, followed through five capabilities. Nothing here was stitched together after the fact — it's the same recording, read five ways.

  1. Session Replay · 0:24

    A visitor tries to add a jacket. The cart API answers 500 — three times.

    The replay shows the click, the failed POST, the console error and the alert the visitor saw, with the request's headers and timing docked beside the stage.

    Session Replay
    /sessions/b8c8ca3e
    Session Replay — A visitor tries to add a jacket. The cart API answers 500 — three times.
  2. Funnels · step 3 of 5

    It isn't one visitor. The funnel loses them between product and cart.

    Five steps from landing to purchase, with the drop at each one. The widest gap is the step this failure sits on — click it and the sessions behind the number queue up.

    Funnels
    /funnels
    Funnels — It isn't one visitor. The funnel loses them between product and cart.
  3. AI Insights · cause card

    The cause card has already named it: cart service unavailable, 588 sessions.

    Failures ranked by the conversions they cost, with the error text, a Watch link to the recordings and a Track button. Nobody had to read ten thousand sessions to find it.

    AI Insights
    /insights
    AI Insights — The cause card has already named it: cart service unavailable, 588 sessions.
  4. App Monitor · POST /api/cart

    On the server it's the same request — 2.8% errors, p95 173 ms.

    The failed request in the replay opens the trace that produced it: the endpoint, the query, the third-party call. Browser and backend on one timeline, no second tool.

    App Monitor
    /app-monitor
    App Monitor — On the server it's the same request — 2.8% errors, p95 173 ms.
  5. Infrastructure · db-01 · memory 98%

    And underneath, the box ran out of room: memory at 98%, swap climbing.

    One agent per host, reading the machine every ten seconds — memory pushed to 98% from a steady 82%, swap from 30% to 50%, CPU and I/O pressure climbing with them, on the same clock as the session. “Was the server struggling when that visitor was?” stops being an argument.

    Infrastructure
    /infrastructure
    Infrastructure — And underneath, the box ran out of room: memory at 98%, swap climbing.
Browser to backend

The server, reached from the session.

Replay tools stop at the browser. Here a failed request opens the trace that produced it, a slow query opens the session that ran it, and the host underneath reports in through one agent — one request, one ruler, top to bottom.

trace 8f21c04a · one request, browser to host71 ms · 500
0 ms20 ms40 ms60 ms
Browser
Server
Database
Host
  1. Browserclick · Add to cart
  2. Browserfetch POST /api/cart→ 500
  3. ServerPOST /api/cart500 · 71 ms
  4. DatabaseSELECT carts
  5. DatabaseINSERT cart_itemslock timeout
  6. Databaserollback
  7. Hostweb-01 · healthy
  8. Hostdb-01 · mem 82%
Read in one sitting: the click, the 500 it got, the insert that waited 41 ms for a lock, and the database host at 81% memory while it did.open either end · same moment

W3C traceparent, on by default

The tracker stamps first-party requests; the server span carries the same id. One click joins them, in either direction.

OpenTelemetry, as-is

Point any standard OTel exporter at LogClip — Node, Java, Python, Go. No proprietary SDK, no re-instrumenting. Logs ride the same endpoint.

Two lines for the host

The agent installs from npm and enables itself as a hardened systemd service — CPU, memory, disk, network and the processes that matter. The install is in the Infrastructure section below.

Backend · Infrastructure

The hosts underneath, watched.

One agent per host reads the box every ten seconds — CPU with I/O wait and steal, memory and swap, pressure, disk and network, sockets and file descriptors, and every service and container on it — on the same timeline as the sessions and traces. “The site feels slow” gets answered with the machine it runs on.

Host agent

Two lines per host. It installs from npm, enables itself as a hardened systemd service and reads /proc every ten seconds — no native dependencies, nothing to configure — with a process snapshot taken when CPU spikes, so the culprit is named.

$ npm i -g @logclip/system
$ sudo logclip-system enable --key sk_live_… --group web

Fleets, not zombies

Group hosts with --group and alert on the fleet’s size. A host that retires cleanly, or goes silent for an hour, stops alarming and keeps its history.

Workloads, not just the box

Every systemd service and container gets its own CPU, memory, pids and disk I/O from cgroup v2 — the host's pressure attributed to what caused it.

Requests, from the access log

Tail nginx, Apache or Tomcat logs on the host: throughput, status classes and p50/p95/p99 per route. No app changes, and no log lines leave the box.

Knows where it runs

AWS, GCP, Azure and DigitalOcean metadata labels the host with region, zone and instance type — and the autoscaling group becomes its fleet.

web · 11 · worker · 4db · 3 · memory 82% on db-01cache · 2 · edge · 4
fleet · 24/24 hosts reporting 112 cores · 296 GB · 10 s samples
db-01db
50%
82%
web-06web
46%
67%
worker-03worker
55%
64%
db-03db
39%
66%
cache-01cache
18%
51%
+19more hosts, all healthy · web · worker · cache · edge
web-12retired on a clean shutdown · history kept, no alarm
db-01 · the warning, openedmemory 82% · alert at 80%
cpu
50%
i/o wait 6.2 · steal 0
memory
82%
swap 34% · psi 12
load
3.6
8 cores · 0.45/core
disk /
64%
inodes 9% · psi io 9
disk i/o
42% busy
4 r · 38 w MB/s
network
4.6 ↓ 3.1 ↑
MB/s · 2.4k pps
tcp
412
1,204 time_wait
oom kills
0
fds 3% · up 41 d
workloads · cgroup v2
postgresqlservice16.9%20.9 GB48 pids
pgbouncerservice0.9%39 MB6 pids
backup-agentcontainer1.4%975 MB5 pids

The fleet's network is totalled, never averaged, and its one warning is named rather than buried. From here, turn on tracing or log shipping for postgresql in one click — no second agent.

recent logs · storefront-apiAllWarn+
10:41:02WARNstripe webhook signature check took 1.9 sno trace · kept: WARN
10:41:09WARNpg pool at 18/20 connections for 12 sno trace · kept: WARN
10:41:15INFO→ GET /api/carttrace 8f21c04a
10:41:15INFO← GET /api/cart 200 · 28 mstrace 8f21c04a
10:41:24ERROR← POST /api/cart 500 · insert cart_items: lock timeouttrace 8f21c04a · session b8c8ca3e
trace 8f21c04a · POST /api/cart · 71 ms▶ session b8c8ca3e · 0:24

Backend · Log Management

Every log, tied to its trace.

Logs arrive with a trace id and are attached to the request that emitted them, so the line that explains the failure is already on the screen where you noticed it — beside the span, and one click from the replay of the person who hit it. No time window to guess, no second query language.

OTLPSame exporter, same endpoint and key as traces. Set OTEL_LOGS_EXPORTER=otlp and they ship.
WARN+Always kept, trace or no trace — a failing deploy announces itself.
INFO · DEBUGKept when the line carries a trace id; trace-less chatter is dropped.
console.logIn Node, @logclip/otel-console reads the active span so a bare console.log carries its id too.
7 daysDefault retention, ~8 KB per message. Capture is opt-in per workspace, masked like replay.