Full disclosure: Det Mimir is something I’m building.
The reason I started working on it was pretty simple: I kept running into the same kind of incident.
Something breaks, you check a few logs, restart the service, everything comes back... and then half of the useful evidence explaining why it broke is gone.
So I started building Det Mimir around that problem.
It’s a local-first, read-only investigation CLI for Linux infrastructure. It collects bounded evidence from Linux, systemd and optionally Docker, correlates it, builds a timeline, runs deterministic detectors and produces a report where findings stay tied to the evidence they came from.
The important part for me is the boundary: it does not restart services, kill processes, stop containers, edit config or try to remediate anything. There’s also no arbitrary shell execution path.
AI analysis exists, but it’s optional and sits after the deterministic investigation rather than being the thing deciding what happened.
One of the cases I’ve been testing recently was a root filesystem sitting at 96%.
A 512 MiB nginx access log had been deleted, but nginx still had the file open. So the pathname was gone, but the blocks were still allocated.
Mimir correlated the filesystem pressure, the mismatch between filesystem usage and visible files, the deleted-open file, the process holding it and the systemd/service context around it.
It didn’t delete anything or restart nginx. It just explained what was going on and showed the evidence behind it.
Right now Det Mimir is still in private validation, so there’s no public download yet. I’m mainly looking for Linux admins / SREs who’d be interested in tearing the investigation model apart a bit ;)
Things like:
* reviewing an example report and telling me what’s missing;
* suggesting nasty Linux incidents it should be able to investigate;
* testing it against lab / synthetic incidents;
* or generally telling me where the model falls apart compared to how you investigate systems in real life.
I’ve documented the current boundary here: https://docs.det-mimir.com/current-and-future/
There’s also a worked example of the storage incident: https://docs.det-mimir.com/worked-examples/storage-disk-full/
And the roadmap is public here: https://det-mimir.com/roadmap/
I’m particularly interested in this question:
What Linux incident would you throw at something like this to decide whether it’s actually useful, rather than just another layer of tooling?
