Replace Your Entire Orion Stack With One Unified Agent

Data Granularity

✅ Per-Second
Every metric collected every second, zero sampling

⚠️ 5-Minute Default
Polling-based intervals, often configurable to 1 min

Visualization Latency

✅ Sub-2-Seconds
Event to dashboard in under 2 seconds

⚠️ Minutes
Polling cycles plus central processing delays

Architecture

✅ Edge-Distributed
Linux-native agents, data stays local, no SQL needed

⚠️ Central Windows+SQL
Heavy Orion server, SQL Server dependency required

Setup Complexity

✅ Minutes
Auto-discovery, zero-config dashboards, instant data

❌ Weeks
Windows+SQL install, template building, node import

Scalability

✅ Linear and Distributed
Add agents without central performance impact

⚠️ Central Bottlenecks
Additional Polling Engines needed for scale

Machine Learning

✅ On Every Metric
18 models per metric, automatic, zero configuration

❌ Not Included
No built-in ML anomaly detection platform-wide

AI Troubleshooting

✅ Built-In
AI root cause, blast radius, natural language queries

❌ Not Available
No AI-powered troubleshooting or reporting

Module Licensing

✅ One Unified Agent
All capabilities in a single deploy, no add-ons

⚠️ Stacked Modules
NPM, SAM, NTA, NCM, IPAM licensed separately

Data Ownership

✅ Fully On-Premises
All observability data stays on your infrastructure

✅ Self-Hosted
Orion runs on your Windows+SQL infrastructure

Open Source

✅ GPLv3+ Agent
Fully open source core, 800+ integrations

❌ Proprietary
Closed source, vendor-locked ecosystem

Logs Management

✅ Zero Pipeline
Direct journal access, no ingestion or indexing servers

⚠️ Separate Product
Kiwi Syslog or Log Analyzer needed for logs

Cost Structure

✅ Per-Node Flat
Unlimited metrics, logs, users, no cardinality charges

⚠️ Module-Based
Per-module, per-node, per-element licensing tiers

O/S Monitoring

✅ Ideal
Per-second CPU, RAM, disk, network for all OS types

✅ Good
Via SAM, 5-minute polling default intervals

Network Device Monitoring

✅ Advanced
Auto-discovery, 150k trap defs, 800+ SNMP vendors

✅ Advanced
NPM module, strong SNMP heritage and tooling

Network Traffic Analysis

✅ Advanced
NetFlow/sFlow/IPFIX with Sankey and city maps

✅ Advanced
NTA module, robust flow collection and analysis

Network Topology

✅ Advanced
LLDP/CDP topology with dependency drill-down

✅ Good
Topology discovery within NPM module

Containers and Kubernetes

✅ Ideal
Per-second cgroups, pod lifecycle, native Helm chart

⚠️ Limited
Container Monitor, not Kubernetes-native by design

Database Monitoring

✅ Advanced
Top queries, deadlocks, 15+ databases built-in

✅ Good
DPA add-on product, separate licensing required

Process Monitoring

✅ Ideal
Per-second per-process CPU, memory, and I/O

✅ Good
Via SAM, periodic process monitoring

Hardware Monitoring

✅ Advanced
IPMI, GPU, sensors, NVMe, ECC, PCIe AER

✅ Good
Via SAM hardware health monitoring

Custom Metrics

✅ Ideal
StatsD, OpenMetrics, OTel, Nagios plugins, 800+ total

⚠️ Limited
Custom pollers, APEX, additional configuration needed

Synthetic Checks

✅ Advanced
HTTP, TCP, DNS, ping all built into the agent

✅ Good
Via SAM/WPM module, separate add-on

Hypervisor Monitoring

✅ Advanced
VMware, Proxmox, Hyper-V, KVM, libvirt per-second

✅ Good
Virtualization Manager module, separate license

Logs Management

✅ Advanced
Direct systemd-journal and Windows Event Log access

⚠️ Separate Product
Kiwi Syslog Server or Log Analyzer needed

Real-Time Infrastructure Monitoring

✅ Ideal
Per-second, all metrics, zero configuration, instant on

⚠️ Periodic
5-minute polling, template-driven dashboards

Live Troubleshooting

✅ Ideal
Console replacement, per-second, browser-based with history

⚠️ Limited
Periodic data, SSH still needed for live diagnostics

Root Cause Analysis

✅ Ideal
ML correlation, anomaly advisor, AI natural language

⚠️ Manual
Alert-based investigation, no ML or AI assistance

Network Traffic Analysis

✅ Advanced
NetFlow/sFlow/IPFIX with Sankey and geographic maps

✅ Advanced
NTA module, robust flow collection and reporting

Capacity Planning

✅ Advanced
Multi-tier retention, AI capacity planning reports

✅ Good
Trending and forecasting in reporting modules

Multi-Site Monitoring

✅ Ideal
Distributed agents, per-region parents, unified Cloud

⚠️ Central
Additional Polling Engines and APEs needed for scale

Alert Management

✅ Advanced
400+ pre-configured component-level alerts, ML enhanced

✅ Good
Alerting engine with threshold-based rules

Team Collaboration

✅ Advanced
Rooms, RBAC, shared dashboards, SSO, audit logs

⚠️ Basic
Account-based access, limited collaboration features

Application Monitoring

⚠️ Good
Process, resource, log-based insights, no distributed tracing

✅ Good
SAM module, multi-application availability monitoring

Configuration Management

❌ Not Available
Observability only, pairs with a dedicated config tool

✅ Advanced
NCM module handles config backup and push

IP Address Management

❌ Not Available
Not an IPAM system, outside observability scope

✅ Advanced
IPAM module for subnet and DHCP scope management

Distributed Tracing

❌ Planned
OTLP trace ingestion on roadmap, not yet shipping

❌ Not Available
Not part of the Orion platform suite