Riemann
Riemann is free, open-source software for monitoring distributed systems through event processing.
What Riemann is
Riemann is free, open-source software for monitoring distributed systems through event processing. It gathers events from servers and applications, then lets configurable Clojure streams filter, combine, modify, and act on those events. Event data can describe exceptions, request latency, CPU, memory, disk state, tags, metrics, time, TTL, and custom fields. Its index keeps the latest event for each host and service until the TTL expires. A dashboard displays queried state and matching events in real time through websockets, while Riemann-dash adds interactive index visualizations. Email alerts and PagerDuty integration support SMS or phone notifications, with routing, enrichment, and deduplication available. Streams can be forwarded to Graphite, and a Librato Metrics integration is documented. Clients submit events over Protocol Buffers using TCP or UDP, with libraries for many languages. Deployment options include packages, configuration tools, Docker, and other documented methods. TLS authentication is supported for TCP connections.
Good
- Open-source and free
- Configurable Clojure event streams
- Real-time websocket dashboard
- Email and PagerDuty alerts
- Many client language libraries
Watch out
- UDP delivery can lose events
- Automatic workload sharding is unavailable
- Sharding mechanics require user design
- Configuration requires Clojure knowledge
Who it suits
Riemann suits operations staff managing large, changing infrastructure and engineers examining production errors or performance bottlenecks. It is aimed at users comfortable configuring event streams in Clojure and designing their own sharding approach.
Verdict
Riemann combines event collection, stream processing, dashboards, and alerting for distributed-system operations. Its lack of automatic sharding and reliance on configurable Clojure workflows matter when planning deployment.
The facts
Each one read from Riemann's own pages, with the date it was checked.
What it does
- Alerts
- Riemann can throttle or roll up events into email alerts and integrate with PagerDuty for SMS or phone alerts.checked 11 Oct 2026
- Audience
- The maker describes Riemann as intended for operations staff managing large dynamic infrastructure and engineers investigating production errors and performance bottlenecks.checked 11 Oct 2026
- Client languages
- The clients page lists libraries for C, C++, C#, Clojure, Elixir, Erlang, Go, Java, Lua, Node.js, OCaml, Perl, Python, Ruby, Rust, and Scala.checked 11 Oct 2026
- Client protocol
- Clients use Protocol Buffers over TCP or UDP to submit events and query the index.checked 11 Oct 2026
- Configuration
- Riemann configuration is a Clojure program that can be extended with custom functions.checked 11 Oct 2026
- Dashboard
- Riemann-dash uses websockets to display interactive visualizations of the Riemann index.checked 11 Oct 2026
- Dashboards
- The dashboard displays queried system state and can show matching events in real time over websockets.checked 4 Oct 2026
- Deployment
- The maker documents running Riemann in Docker and provides a prepackaged riemannio/riemann image.checked 11 Oct 2026
- Event data
- Events can include host, service, state, time, description, tags, metric, TTL, and custom fields.checked 11 Oct 2026
- Event processing
- Riemann filters, combines, and acts on event flows to help understand systems.checked 11 Oct 2026
- Integrations
- The maker lists forwarding events to Graphite and a built-in Librato Metrics integration.checked 11 Oct 2026
- Intended users
- The site describes Riemann as intended for operations staff managing large, dynamic infrastructure and engineers investigating production errors and performance bottlenecks.checked 4 Oct 2026
- Limits
- Riemann cannot automatically shard workloads, so users must choose sharding axes and build the aggregation and discovery mechanics.checked 11 Oct 2026
- Monitoring
- Events can report application exceptions and request latency as well as host CPU, memory, and disk state.checked 4 Oct 2026
- Operational limit
- The site notes that UDP is lossy and recommends TCP for reliable delivery and acknowledgement.checked 4 Oct 2026
- Performance
- The site says a stock configuration on commodity x86 hardware can handle millions of events per second at sub-millisecond latency, with 99th-percentile latency around 5 ms.checked 4 Oct 2026
- Protocols
- Riemann accepts Protocol Buffers over TCP and UDP; its documented servers also include TLS and websockets.checked 4 Oct 2026
- Purpose
- Riemann aggregates events from servers and applications and processes them with a stream processing language.checked 11 Oct 2026
- Security
- Riemann supports bidirectional TLS authentication for TCP connections, and its documentation also describes using a VPN or SSH tunnel.checked 11 Oct 2026
- Speed
- The maker says a stock configuration on commodity x86 hardware can handle millions of events per second at sub-millisecond latencies, with 99th percentile latency around 5 ms.checked 11 Oct 2026
- State index
- Its index stores the latest event for each host and service, and removes entries when their TTL expires.checked 11 Oct 2026
- Stream processing
- Its configurable streams can filter, combine, alter, and act on events, and the configuration is written in Clojure.checked 4 Oct 2026
- Support
- The maker directs users to IRC, a mailing list, or GitHub Issues for help and describes Riemann as a volunteer effort.checked 11 Oct 2026
Alternatives to Riemann
- 1
Wazuh
Free planOpen sourceWebAPILinuxmacOS8.4From $571 a month - 2
PagerDuty
Free planAndroidiOSWebAPI8.3From $21 a month - 3
xMatters
Free planAndroidiOSWebAPI8.3From $15 a month - 4
AlertOps
Free planAndroidiOSWebAPI8.1From $8 a month - 5
MISP
Free planOpen sourceWebAPILinuxSelf-hosted7.9From €7.31 a year - 6
UTMStack
Open sourceWebAPILinuxmacOS7.9From $238.80 a month