Collect and transform
From the whole stack: legacy and modern, hardware and software, across domains. The agent chooses what to gather, how to parse it, and how to shape it into the lake.
Telemetry sources: modern softwarelegacy deviceshigh-volume infrastructuremodern devicesmodern infrastructurelegacy infrastructurehigh-volume softwarehigh-volume hardwareany vendorany formatcross-domaincross-stack
Logs, metrics and traces in your private lake.
Ground truth for agentic automation.
Bring telemetry together in your own private lake. Correlate failures, investigate root causes, and give agents the evidence to act safely.
infra-ops-agent · ffwd-mcp · on-prem
live
>
deploy ffwd uc: syslog+snmp switches, gpu on ai rack
provisioning universal collector · snmp + dcgm
Collector deployment → telemetry lake
uc-net-07
syslog+snmp
OK
udp/514 · legacy-switches/* · attached
uc-gpu-03
dcgm
OK
nvidia gpu · ai-rack-07 · 8× H100 · attached
streaming to ffwd · 0 backlog
→ destination
FFWD Telemetry Lake · Iceberg (long-term)
>
why is splunk ingest up 38% this week?
querying flow stats via ffwd · 7d window
Ingest by source → splunk
Burst alarms · edge-rtr-04
06:12:03
edge-rtr-04
WARN
LinkDown · ge-0/0/7
06:12:09
edge-rtr-04
WARN
LinkUp · ge-0/0/7
06:12:14
edge-rtr-04
WARN
LinkDown · ge-0/0/7
… clustered ×41,208 in 6h 28m
⚠ root cause
interface flapping · ge-0/0/7
>
cut splunk ingest 70% — keep all security signal
profiling firewall-logs · 7d · 312 patterns → T7
step 0 · dedupe
measured −19%
⚠ auth_failure excluded · repeat count = brute-force signal
step 1 · tag at UC edge
crit high med low noise
step 2 · reduce at sink
shortfall only
step 3 · delete tags
raw logs stay raw
VERIFY
ingest ✓
parse ✓
egress ✓
content ✓
symptomatic
1,284 → 1,284
flat ✓
ⓘ 70% would cut crit/high — achievable 58%
✓ applied 58% · full copy retained in FFWD · rollback armed
>
reset ge-0/0/7 on edge-rtr-04 to stop the flapping
executing via ffwd · risk evaluation
Action plan · destructive
[1/3]
resolving edge-rtr-04
✓
[2/3]
connecting as net-operator
✓
[3/3]
issuing interface reset
⛔
Blocked by FFWD safety gate
production change window · requires human approval
Agents trace logs at machine speed. They need data that can keep up.
Observability grew up around dashboards and metrics because a person cannot read terabytes of logs. Agents can, and a number on a chart does not tell them what to do, so they trace the log and act.
Filter the signal
Terabytes come in. Anomaly detection and filter rules keep the useful signal in fast, short-term storage, so agents act now instead of reading the raw lake.
Fully agentic
Agents configure collection and trace the cause themselves, which shortens the time to recovery. Older history moves to low-cost Iceberg storage and stays queryable.
The pipeline that feeds your lake and beyond.
Collect telemetry from any domain, transform it in real time, and feed your private lake and external destinations. Agents operate the pipeline directly and cut data volume and cost at expensive destinations.
Any domainHigh-performance transformAny destinationTB/hrReduce costs
Collect from any domain, transform in the pipeline and ship to any destination.
Keep the history in the lake and send only the signals that matter, which reduces cost and volume at destinations.
See the telemetry pipeline →Keep the history in the lake and send only the signals that matter, which reduces cost and volume at destinations.
Agents run it
Claude, Codex or any other common agent chooses what to collect, how to parse it and what to reduce.
- ✓collect from any domain, at TB/hr
- ✓high-performance transform in place
- ✓ship to any destination
Log-centric anomaly detection and correlation. 100% unsupervised
All telemetry is treated as logs, with six independent evaluators. Correlation comes from unsupervised pattern scores, with no topology map or human-authored policy behind it.
DRAIN + JSD
Log structure and distribution drift
BERT sequence
Order-aware modelling of event sequences
LSH fingerprinting
Semantic similarity and never-before-seen lines
HDBSCAN
Numeric clustering across metric space
Time-series forecasting
Expected-band deviation and spike analysis
Cross-domain correlation
Silicon to application, in one causal chain
Others: Typical "AIOps"
Noise without a trail
- Alert storms and false positives
- Silent failures stay silent
- No evidence, so root cause is still a human hunt
FFWD
Evidence, then root cause
- The symptomatic log lines, not a metric spike
- Evidence logs stored for near real-time audits
- Correlated patterns your agents can troubleshoot from
Runs entirely inside your walls, including the AI.
The models train and run in-cluster on your own GPUs. No telemetry egress, no third-party inference, no data crossing a jurisdiction. The MCP interface your agents talk to sits inside your perimeter too.
ON
On-premises
Your datacentre, your hardware, your network boundary.
PC
Private cloud
Your tenancy in AWS, Azure, GCP or a sovereign provider.
AG
Air-gapped
Fully disconnected environments, including the ML stack.
MT
Multi-tenant
Provider-operated, with tenant isolation for downstream customers.
For operators under data-sovereignty and retention mandates, this decides who can be evaluated at all.
No SaaS dependencyLocal GPU inferenceMCP inside your perimeterFlat licensing, not per-GB
When the infrastructure operator is an AI agent
Nio adds execution-risk scoring and policy gating at the agent boundary. Every tool call is evaluated before it lands, with a local audit trail. It is available today for teams that rely on fast-acting agentic automation.
“ We, SAKURA internet, Inc., is constantly pursuing innovations to help our customer's business run more efficiently and smoothly. We are very honoured to contribute their success by offering FFWD, a superior observatory services on our IaaS service, “SAKURA's Cloud”, (so-called, Logging as a Service) provided in SaaS format through this partnership. ”
“ Capabilities such as infrastructure self-recovery and fast time to restoration after failure are very important to our business. Logs and events are essential clues and triggers to achieving these capabilities. FFWD helps us to affordably collect, analyse and monitor our infrastructure logs and events in real-time, improving our operational reliability and efficiencies. ”