Zurich 13:52:28
UTC 12:52:28
Open incidents P10 P21 P31 P40 Devices down 0/40 1 degr. Active alerts …
Syslog / s 0.0
MTTR today 11m 19s
live
Live
13:51:57 acc-brn-3 %LINK-3-UPDOWN: Interface GigabitEthernet1/0/9, changed state to up 13:51:16 rtr-bsl-2 %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart License Utility (CSLU) : Unable to resolve server hostname/domain name 13:50:06 acc-brn-1 %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to up 13:47:01 INC-1005 opened: Bern: network alarm, no user impact so far (P3) 13:46:00 INC-1003 expired: SLA breached 13:38:26 Chaos monkey off (every ~300s, max 2) 13:38:25 Chaos monkey on (every ~300s, max 2) 13:36:00 INC-1004 opened: Many failed logins on the network devices (P2) 13:35:24 hannes resolved INC-1002 in 20m36s (+250) 13:16:00 INC-1003 opened: Bern: Intranet unavailable, devices not answering (P2) 13:14:47 INC-1002 opened: Bern: Intranet unavailable, devices not answering (P2) 13:13:36 hannes resolved INC-1001 in 2m01s (+292)

About NOC-POC

A NOC command center for a simulated Swiss federal network, with a game on top.

What this is

A simulated network of 43 devices at five sites (Bern, Zürich, Geneva, Basel, Lugano), watched by a real observability stack: VictoriaMetrics, VictoriaLogs, vmalert, Vector and Alertmanager.

The NOC shift game: incidents arrive as tickets that only describe symptoms. The team investigates with the map, the embedded tools and AI over MCP, and answers "What do you do next?" The first right answer wins.

Where to look

  • Map: the network live, as monitoring sees it.
  • Incidents: the tickets of the shift, with their SLA.
  • Alerts, Metrics, Logs: karma, vmui and VictoriaLogs, embedded.
  • Chat with the AI assistant, or Connect AI: your own client over MCP.
  • Lab to break the network on purpose, Leaderboard for points and ranks.

How to start

  1. Sign in with your email: you get a link, no password.
  2. Open Incidents.
  3. Take an open ticket, or pull the next incident when the inbox is empty. Investigate and answer.

Sign in Without signing in you can watch.

The stack

The NOC-POC stack Browsers use the NOC-POC app (network simulation, exporters, tool proxy, LiveView UI, PostgreSQL, topology MCP, AI chat, OAuth server). The simulation sends syslog to Vector, which stores it in VictoriaLogs; vmsingle scrapes the exporters. vmalert evaluates metric rules on vmsingle, vmalert-logs log rules on VictoriaLogs; both alert through Alertmanager, shown by karma. Vector sends syslog alerts to Alertmanager and receives its webhook for the alert history. AI clients and the in-app chat call agentgateway with an OAuth token; it routes to the metrics, logs and alerts MCP servers and the app's topology MCP. The metrics and logs MCP servers query through vmauth. The chat calls the LLM providers. APP · NOC-POC (PHOENIX, ASH) OBSERVABILITY STACK (DOCKER / K8S) AI / MCP Browser players and visitors AI clients Claude Code, Claude Desktop, VS Code, Cursor Network simulation 43 devices · 5 sites · faults Exporters /snmp /probe /node /sd /metrics Tool proxy /tools/* karma, vmui, VictoriaLogs, vmalert LiveView UI map · incidents game · lab leaderboard · wallboard PostgreSQL users · incidents · scores · chats Topology MCP /mcp/topology (CMDB) AI chat ReqLLM · AshAi tool loop OAuth 2.1 server MCP access tokens (JWT) Vector syslog pipeline VictoriaLogs log store vmalert-logs log rules vmsingle VictoriaMetrics vmalert metric rules Alertmanager routing · inhibition karma the Alerts view vmauth token check in front of VM and VL Metrics MCP mcp-victoriametrics Logs MCP mcp-victorialogs Alerts MCP mcp-alertmanager agentgateway one MCP endpoint (:3000/mcp) JWT check · per-tool rules LLM providers Anthropic · OpenAI snapshot embeds syslog scrape syslog alerts · alert history MCP with the user's OAuth token
Metrics Logs Alerts MCP and tokens Web, APIs, inside the app