How it works · Step 2 of 4
For the person carrying the pager
Investigate: what the alert left out
An alert carries a metric and a threshold. What you need is the five things around it — and getting them has always meant logging in at 2am.
The gap
For the person carrying the pager
An alert tells you a number. It doesn’t tell you the situation.
“Memory above 90% for five minutes on app-server-02” is true and nearly useless on its own. Which process? Since when? Was anything deployed? Is it one host, or spreading? Is anything else on the box going the same way? Each of those is a command someone types after logging in, and the typing is what the night is made of.
Whether the fix is any good gets settled here. A restart without knowing what was eating the host is a guess — one that works often enough to be dangerous.
What Virca does
For the engineer who has to approve it
It gathers the evidence on the host, before it changes anything.
The approved read-only checks run where the problem is. What is consuming the resource, and for how long. What changed recently. What else on the host moved at the same time. Whether the same signature shows up on siblings. Facts from the machine, in seconds — captured, so your team reads something in the morning instead of a mystery and a graph.
Evidence first, then the fix
The order matters. Snapshots and process detail are collected before the action runs, because a restart destroys the evidence of what caused it. You get the fix and the explanation, not one at the cost of the other.
It accumulates
Every pass is recorded, so the third occurrence can be compared with the first two. Three unrelated bad nights become one pattern with evidence attached.
Sometimes findings are the whole answer
Not every event should end in a change. “Here is what I found, this needs a human call” is a legitimate ending — in team chat, detail attached, read when you choose to read it.
And you can ask follow-ups
The same agent is reachable over MCP from your own AI client. “Why did that host restart last night?” comes back from the record — you don’t rebuild it from dashboards. Ask it from the client you already have open →
What this is not
For whoever picks the tools
Gathering facts is not naming a cause.
Exactly where the line sits
The line holds in both directions. It names which system or which process is implicated, with the evidence it used, and stops there. Past that it is a code question — and a code question belongs to the team that wrote the code, not to the thing whose job is getting the service back up at 3am.