Tink vs Promtail
Promtail is Grafana's log shipper: scrape configs, pipeline stages, and a positions file that push lines into Loki. That is not a mechanic. Tink installs in one command, watches the Linux server, explains what is wrong, and helps you fix it.
Promtail scrapes files. Tink answers “why is this VPS sick?”
Accidental sysadmins land on Promtail because every Loki diagram still puts a scraper in front of Grafana. Then the disk fills, nginx dies, and the scrape job is quiet — nothing was tailed, so nothing fired.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep Promtail if you already operate Loki. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | Promtail |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Hours — promtail-config.yaml, scrape jobs, relabel rules, Loki tenants, and Grafana dashboards |
| What you get | Working monitoring, diagnosis, and approved fixes | A shipper. Disk, nginx, and certs stay your problem until a scrape job sends the line |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Free software (Grafana). You still pay for Loki storage, Grafana Cloud ingest, and the engineer who debugs the positions file |
| Hidden costs | None — fully managed | Dropped streams, label cardinality explosions, scrape lag, and a second tool to alert on CPU, disk, and restarts |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Scrape configs. Promtail does not watch a quiet disk unless you tailed that path |
| Configuration | None after install — heuristics and AI | scrape_configs, relabel_configs, pipeline_stages, and which positions.yaml offset skipped the rotate |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | You LogQL the stream, then SSH in to change the box |
| Fix execution | Proposes and executes approved commands with an audit trail | Ship only — Promtail cannot restart nginx or free disk |
| Alerting | Built-in across 8 channels | Not a Promtail job — Loki ruler, Grafana Alerting, or a sidecar has to fire |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Not a shipper job — a scrape job does not forecast a quiet disk |
| SSH brute-force detection | Built-in — parses auth.log every scan | Only if you scrape auth.log, label it, write LogQL, and wire an alert downstream |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | Silence if Promtail dies — unless you built a deadman check on the Loki side |
| Public status page | Shareable URL with 90-day history | None — Promtail has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | None — a shipper is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire Grafana Alerting into PagerDuty or another incident tool |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | promtail -config.file and Grafana Explore. No mechanic you text when disk filled |
| Learning curve | None — works after install | Medium — scrape jobs, pipeline stages, label cardinality, and Grafana Alloy migration notes |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Teams that already run Loki and only need a file scraper, not a sick-VPS mechanic |
When Promtail is the right choice
Keep Promtail when you already want that exact job:
- A Loki file scraper — you need the binary to push logs into a cluster you already run, not a mechanic.
- Prometheus-style scrape jobs you already trust — systemd journal, syslog, or static file targets feed pipelines you do not want to rebuild.
- A hub behind Loki or Grafana Cloud — edge nodes scrape, something else stores and queries at the hub.
- Application telemetry, not a sick VPS — you hunt request IDs more than disk, certs, and nginx.
The real cost of “just run Promtail”
A shipper is in every Loki architecture diagram. A working ops loop for five Linux boxes is not:
- An indexed stream still means you SSH in and change the box by hand
- Disk, nginx, certs, and SSH brute-force never appear unless you scraped those files and Grafana alerted
- Positions files, dropped streams, and label cardinality punish log rotates and the hours you spend debugging offsets
- A single VPS with a dead Promtail still needs a mechanic, not another scrape job — and Grafana is already pushing teams toward Alloy
For a 5-server team, Tink Mechanic at $45/month is cheaper than the shipper plus the engineer who keeps Loki ingest alive, and every scan includes a diagnosis a quiet scrape job will not type.
No scrape-job homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs Grafana Loki · Tink vs Filebeat · Tink vs Grafana Cloud