Promtail is Grafana's log shipper: scrape configs, pipeline stages, and a positions file that push lines into Loki. That is not a mechanic. Tink installs in one command, watches the Linux server, explains what is wrong, and helps you fix it.
Accidental sysadmins land on Promtail because every Loki diagram still puts a scraper in front of Grafana. Then the disk fills, nginx dies, and the scrape job is quiet — nothing was tailed, so nothing fired.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep Promtail if you already operate Loki. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | Promtail |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Hours — promtail-config.yaml, scrape jobs, relabel rules, Loki tenants, and Grafana dashboards |
| What you get | Working monitoring, diagnosis, and approved fixes | A shipper. Disk, nginx, and certs stay your problem until a scrape job sends the line |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Free software (Grafana). You still pay for Loki storage, Grafana Cloud ingest, and the engineer who debugs the positions file |
| Hidden costs | None — fully managed | Dropped streams, label cardinality explosions, scrape lag, and a second tool to alert on CPU, disk, and restarts |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Scrape configs. Promtail does not watch a quiet disk unless you tailed that path |
| Configuration | None after install — heuristics and AI | scrape_configs, relabel_configs, pipeline_stages, and which positions.yaml offset skipped the rotate |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | You LogQL the stream, then SSH in to change the box |
| Fix execution | Proposes and executes approved commands with an audit trail | Ship only — Promtail cannot restart nginx or free disk |
| Alerting | Built-in across 8 channels | Not a Promtail job — Loki ruler, Grafana Alerting, or a sidecar has to fire |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Not a shipper job — a scrape job does not forecast a quiet disk |
| SSH brute-force detection | Built-in — parses auth.log every scan | Only if you scrape auth.log, label it, write LogQL, and wire an alert downstream |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | Silence if Promtail dies — unless you built a deadman check on the Loki side |
| Public status page | Shareable URL with 90-day history | None — Promtail has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | None — a shipper is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire Grafana Alerting into PagerDuty or another incident tool |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | promtail -config.file and Grafana Explore. No mechanic you text when disk filled |
| Learning curve | None — works after install | Medium — scrape jobs, pipeline stages, label cardinality, and Grafana Alloy migration notes |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Teams that already run Loki and only need a file scraper, not a sick-VPS mechanic |
Keep Promtail when you already want that exact job:
A shipper is in every Loki architecture diagram. A working ops loop for five Linux boxes is not:
For a 5-server team, Tink Mechanic at $45/month is cheaper than the shipper plus the engineer who keeps Loki ingest alive, and every scan includes a diagnosis a quiet scrape job will not type.
No scrape-job homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs Grafana Loki · Tink vs Filebeat · Tink vs Grafana Cloud