rcaSense discovers your topology over SNMP, from LLDP and CDP up to BGP, IS-IS and LDP, and uses it to name the device, link or session that failed, what it took down, and why it thinks so.
Self-hosted · one Go binary · works with the Zabbix you already run
Reads the protocols your network already runs
Four steps, all in one binary: build the inventory, discover the topology, correlate what monitoring reports, and hand the result to the tools your team works in.
Add sources in the UI and rcaSense crawls from them. Each fact about a device comes from the highest-priority source that has it, and anything set by hand wins.
Discovery polls every device it finds, in parallel, and keeps what it no longer sees until you say it is gone. The map starts from a search and expands from there.
bgp down, isis c02
Zabbix webhooks, SNMP traps and rcaSense's own state poller report problems. Fifteen seconds after the last change, rules over the topology decide what failed and what is only a symptom of it.
Incidents go out as they open, change and resolve, from a queue in Postgres that retries without giving up. The topology also writes back into monitoring.
No learning period and no guesswork: rules over the dominator view of your topology, with written evidence for every decision.
A failed device is a root when bringing it back alone would restore the path to the poller. Everything behind it is a symptom, held under one incident.
A device with two parents is a symptom only when both are down. Both cores failing together is one incident naming both, not two.
An IGP adjacency down over an interface that is up is a session fault, "underlay is up". A BGP session cut by a failed link is explained by that link.
Synthetic networks generated by rcaSense, one CPU core. Failures and events come from the same code that knows the topology, so the RCA figure checks the rules, not real alert noise.
rcaSense doesn't replace your monitoring. It reads from it, explains what it reports, and writes the topology back.
Self-hosted only. Nothing leaves your network.
rcaSense and Postgres 16 on a distroless image, running as non-root. UI on :8080, traps on 162/udp.
# set RCASENSE_SECRET_KEY first cp .env.example .env docker compose up -d
One Go binary with the UI embedded. Migrations run on start; incidents survive a restart.
RCASENSE_DB=postgres://... \ rcasense serve -listen :8080
One YAML file in, one topology snapshot out. Discovery and the map, without root cause analysis.
rcasense serve -c rcasense.yaml \ -t topology.json -discover 15m
We'll run the containerlab demo with you: 19 routers, switches and servers running FRR, live BGP, IS-IS and LDP. Pull a switch and see one incident in under a minute.