Sizing
How big the 3AM server should be, why it can be small, what limits how many incidents it works at once, and GPU sizing for running the models yourself.
The short answer
| Estate | Server | Disk |
|---|---|---|
| Up to about 1,000 connected tools | 8 vCPU, 32 GB | 100 GB SSD |
| More than that | 16 vCPU, 64 GB | 500 GB SSD |
| A trial | 2 vCPU, 4 GB | 20 GB |
That's the server for 3AM itself. The models run on a GPU or an endpoint, sized separately (below).
Why it can be small
An investigation spends about 98% of its time waiting: on your databases, your metrics, and the models. In our benchmark, 64 investigations at once used about half of one CPU core. The sizes above leave ten times that headroom.
| 8 vCPU, 32 GB | |
|---|---|
| Investigations at once | 16 by default, 64 is safe |
| Memory used | About 4–5 GB, with 1,000 tools and 64 investigations |
| Disk used | About 100–300 KB per incident in the audit log. 100 GB lasts years |
What sets the pace
- The model endpoint. A hard incident takes about four model steps. At four seconds a step and eight calls at once, that's about 30 hard incidents a minute. Incidents a pack proves don't use the model at all.
- Your systems. 3AM makes at most four calls at a time to any one tool, however many incidents are open, so a burst never floods a database.
- Slow incidents. An incident nothing proves at once is watched for up to three minutes while its symptoms build,
holding its slot. If bursts are common, raise
THREEAM_MAX_CONCURRENT.
When every slot is busy, 3AM works causes before symptoms, then the most severe and most costly incidents, and always keeps one slot free for something new. Environment variables lists the settings.
With GPUs
For large estates that run the models on their own GPUs, with vLLM. These are estimates; replay recorded prompts on your hardware before buying.
| Medium | Large | |
|---|---|---|
| Estate | ~500 services, ~200 investigations a day | ~2,000 services, ~1,000 a day |
| Investigator (Llama 3.3 70B, FP8) | 4× H100 80 GB, or 2× H200 | 6× H100 80 GB, or 3× H200 |
| System 1 (tev1, 4B) | 2× L4 | 2× L40S |
| 3AM server | 8 vCPU, 32 GB, 250 GB SSD | 16 vCPU, 64 GB, 500 GB SSD |
Each investigator copy needs two H100s: the 70B model takes about 71 GB in FP8, and the rest holds the context of
around 35 investigations at once. On Kubernetes, the chart runs it for you (vllm.enabled).
Models
Where 3AM's models run. Your own endpoint, OpenRouter, or a GPU in the server, never the CPU. How to choose, and how to set each one up.
Upgrade
Upgrade 3AM with the same command you installed it with. Your data and settings are kept, and the previous version comes back if the new one doesn't start.