Features
What is actually in it.
Everything on this page is built and shipping today. Where something is partial or has a caveat, it is written next to the thing rather than left out.
Detection
Ten detectors, with published thresholds
None of these is gated by plan. They run on the free tier exactly as they run on Agency.
Missed runs
A scheduled workflow that should have run and did not. Derived from the cron or interval on the trigger, so it fires on the absence of an execution — the case n8n has nothing to alert on.
Green-but-broken
A run n8n marked success that produced no output. Fires as critical when a workflow with at least five successful runs that has always returned items returns none.
Failures
A run that errored, summarised with the node that failed and the error it raised.
Consecutive failures
Three failures in a row, kept separate from single failures so it can be routed to a louder channel.
Error rate
The share of runs failing over a rolling window rather than a fixed count, so a busy workflow and a quiet one are judged on the same terms.
Runtime anomalies
A successful run that took more than three standard deviations and 1.5× longer than its own history.
AI cost spikes
A run whose model spend is an outlier on all three of sigma, multiple and an absolute floor. n8n reports these runs as successful, so nothing else in the stack flags them.
SLA breaches
Error-budget arithmetic per workflow. “You have three failures left this month” is a decision; “99.2% versus 99%” is trivia.
Business thresholds
Your own KPIs, sent as events from the n8n node, alerting when a number moves outside the range you set.
Log thresholds
A burst of log volume or severity from a workflow, instance or source.
The exact numbers are in how detection works.
Collecting
Getting data out of n8n
Two connection modes, three log paths, and an optional real-time hook.
The agent
Runs beside n8n, reads it read-only, reduces executions locally and pushes signed metadata outbound. Works from inside a private network with no inbound rule. Docs.
Real-time capture
An n8n external hook pushes each finished execution immediately. It also catches successful runs n8n itself discards when configured not to save them — which polling can never see. Docs.
Logs, three ways
The n8n community node, raw JSON in whatever shape you already have, or an OpenTelemetry exporter over OTLP/HTTP — JSON and protobuf both accepted. Docs.
Business events
Send your own KPIs from a workflow and alert on the number rather than the exit status. Docs.
Reading
Making sense of it
One timeline, faceted filtering, and the same query grammar in the UI and the API.
Unified log explorer
Log lines, run outcomes and node executions on one stream, filtered by type, severity, workflow, source, environment — or by any attribute in a payload nobody declared in advance.
Runs explorer
Faceted filtering with include and exclude across status, trigger mode, instance, workflow, error class, environment and tags, with keyset pagination and CSV export.
Trace waterfall
Per-node timing for a run, with the log lines correlated to it by execution id.
AI cost tracking
Token counts and estimated spend per model and provider, from a built-in price table you can override. Estimates, recorded at ingest time — not an invoice.
Acting
Doing something about it
Alerting with guardrails, four control actions, and reporting for people who are not you.
Alert channels
Slack, Discord, Telegram, email and signed webhooks, all bring-your-own. Scoped by instance, client and severity, with quiet hours, a rate cap and escalation. Docs.
Control actions
Retry, stop, activate, deactivate. Opt-in, separately keyed, role-restricted and audited. Docs.
Status pages
A public page per instance or client, describing incidents generically so it never leaks an error message. Docs.
Client workspaces
Group instances by client, brand their status page, and send a scheduled report covering the last complete period. Docs.
Integrating
Getting data back out
Read-only, keyed per workspace, with the filter syntax the UI uses.
Public API
Runs, incidents, workflows, instances and CSV export. Read-only by design. Docs.
Prometheus
A scrape endpoint in text exposition format, behind the same bearer auth as everything else rather than on an open side port.
OpenTelemetry export
Every finished run exported as a span tree — run as root, nodes as children — into Jaeger, Tempo or any OTLP collector.
Outbound webhooks
Signed JSON POSTs on incident open and resolve, for PagerDuty, Opsgenie or n8n itself.
The fastest way to evaluate this
Connect one n8n instance on the free tier and leave it for a week. Every detector on this page runs there, so what you learn is whether anything has been failing quietly — which is the only question that matters.