HOWL

Your machines howl home.

How it worksQuickstart
The pack

One howl becomes a pack.

Add a machine and it simply starts howling too. No wolf talks to another wolf - every howl goes to the same moon. That is the whole topology.

The metaphor is the architecture

The moon is the server.

Howl is a tiny log-shipping fleet. Every machine runs a small agent that reads its own log files and pushes them out. Nothing ever connects to a machine - no open ports, no VPN, works from any network.

Wolf→agent

A ~56 MB process tailing log files with byte-exact checkpoints. Measured at 0.2% of one core.

Howl→HTTPS push

Batches ship within about a second. If the moon is unreachable, the log file itself is the buffer.

Moon→receiver

A Cloudflare Worker + D1 + R2. It lives outside your house on purpose - the monitor never shares fate with the monitored.

Pack→fleet

Wolves never talk to each other. Adding a machine is registering a token and letting it howl.

Watch one line travel

Read, ship, then move the cursor.

The agent keeps a byte cursor in every file it watches. It reads what is past the cursor, ships it, and waits for the receiver to say OK - and only then does the cursor move. That ordering is the whole delivery guarantee.

/var/log/syslogcursor 4,096
read up to here

writea process appends bytes to the file

Bytes in, lines out. The agent never asks for “the next line” - it reads a window of bytes from its cursor and splits what comes back on newlines. If the window ends mid-write, that trailing fragment is left alone and the cursor stops at the last newline, so a half-written line is never shipped as if it were whole.

Why the pause matters. The cursor moves only after the receiver acknowledges. Crash in between and the same batch simply goes again - duplicates are possible, gaps are not. If the receiver is unreachable, the cursor stops advancing and the log file itself becomes the buffer.
Under the fur

How the data flows.

Data pushes out; code pulls in. Agents checkpoint after every acknowledged batch, so crashes and restarts re-send instead of losing. The receiver classifies, stores hot, rolls cold, and watches for silence.

machine 1agent tails + checkpointsmachine 2agent tails + checkpointsmachine 3agent tails + checkpointsHTTPS push, ~1sthe receiverclassify error / warn / infohot: 7 days queryablecold: nightly gzip archivewatchdog: silence = alertserverless - no box to babysityour phoneerrors + silence, in secondsquery APIhot + cold, one viewgit mainagents self-update every 15 mincode pulls in
Built like it matters

Small agent, serious guarantees.

Never loses a line

Checkpoints advance only after the server acknowledges. Rotation, deletion, truncation, even in-place rewrites - drained and fingerprinted, proven by a zero-loss test harness.

Alerts that respect you

One push per incident, not five hundred. Errors buzz in seconds; a machine going quiet buzzes once; a source that stops shipping while its machine looks healthy gets caught too.

Updates itself

Push to main and every wolf is running it within fifteen minutes. Failed builds keep the old agent alive. Restarts are lossless by construction.

0.2%

of one CPU core, measured on a live machine. 56 MB of memory. Under 2 MB of network a day when idle.

~1s

from a line hitting a log file to it being queryable at the receiver, classified and stored.

$0

of always-on servers. The receiver is a Cloudflare Worker; a home fleet fits comfortably in free tiers.

Join the pack

A new wolf in four lines.

# on the new machine
git clone [email protected]:you/howl.git ~/howl
cd ~/howl/agent && npm ci && npm run build
node dist/agent.js init --endpoint https://your-moon.example --token howl_...
# install the service units - and it howls forever
Open source, soon. Howl runs a real fleet today. The repo goes public once the rough edges are sanded - the design writeup is already out: Working Through Log Data at Datacenter Scale.