Self-host it, fork it, run it as a service — the license terms are the same for everyone, including us. There's no separate commercial edition and nothing held back behind a paid tier: the code you can read is the code that runs.

AGPLv3's network-use clause means that if you modify Cairn OBS and offer it to others over a network — including as a hosted service — you're required to make your modified source available to those users too. That's a deliberate choice, not an oversight: it's the same protection that keeps this project itself safe from being taken closed-source downstream.

The name

Four stones, stacked so they can be read at a glance

A cairn is one of the oldest pieces of infrastructure humans build: a pile of stones, placed by hand, left standing on a trail so that someone who comes later — hours later, or years later, a stranger who never met the person who built it — can look at it and know someone was here, and this is the way through. Scottish hill-walkers use them. Nordic and Arctic travelers use Inuksuit for the same purpose. Long before GPS, a cairn was the original out-of-band signal: asynchronous, unattended, and legible to anyone who understood how to read one.

That is, almost exactly, what a log line is. A process writes it at 3 a.m., under conditions nobody is watching in real time, and walks away. Its only job is to still make sense hours or weeks later, to an engineer who wasn't there when it happened and is trying to reconstruct, stone by stone, what actually occurred. One log line is a pebble. A well-built observability platform is the cairn — the accumulated, load-bearing structure that turns a scatter of individually meaningless stones into something you can actually navigate by, especially in the exact conditions a cairn was designed for: poor visibility, bad weather, somebody trying to find their way through when it matters most.

Signals stacked, and left for someone to read.

The four tapering stones in the mark aren't decoration — they're the shape of the pipeline itself: an edge signal, carried through transport, landed in storage, stacked one layer on the next until there's enough structure to actually stand on. OBS is just what it says on the label: observability. The cairn part is the promise underneath it — that what gets built here is meant to outlast the moment it was written, and to still make sense to whoever's standing in front of it next.

Why this exists

Most logging tooling was designed for a world that doesn't exist anymore

A lot of the log-tooling landscape still runs on paradigms that are decades old — conventions built for a single machine writing to a local flat file, or enterprise platforms architected around one on-prem datacenter with a fixed number of boxes you could point at. Those tools didn't fail; they did exactly what they were built for. What's changed is everything around them. Workloads are now containers that live for minutes. Infrastructure spans multiple clouds plus whatever's still running on-prem, often inside the same organization, sometimes the same afternoon's incident. Failure modes are distributed by default, not "the one box that's down." And the old tools got bent, extended, and duct-taped to cover ground they were never designed to cover — because ripping out load-bearing logging infrastructure is exactly the kind of project nobody gets time or budget to do properly.

The mismatch shows up in specific, familiar ways:

• 01 Per-GB ingest pricing that punishes the verbose logging an incident actually needs, so teams quietly log less than they should.
• 02 "Which cloud, which datacenter" treated as an afterthought instead of a first-class dimension of every query.
• 03 Free-text search and structured querying sold as two different products instead of one query language over both.
• 04 Alerting and AI assistance bolted on as a separate, often unauditable paid layer instead of built into the query path itself.

Cairn OBS starts from the present instead of retrofitting the past: cloud and on-prem logging as equally first-class inputs from day one, not a legacy on-prem product with a cloud add-on bolted on later, and not a cloud product that treats on-prem as an unsupported edge case. AI-assisted search and alerting live inside the same compiled query path every hand-written query already runs through — not a separate black-box service you have to trust blindly, and not a feature held back for a paid tier. The whole thing ships AGPLv3, on purpose, so the platform you're depending on during an incident is one you can actually read the source of.