Command line
Every 3am-core command, with what it prints.
The binary is /opt/3am/3am-core in the 3AM container. Run it with exec:
podman exec 3am-core /opt/3am/3am-core <command>Tip: alias 3am='podman exec 3am-core /opt/3am/3am-core'.
Commands
| Command | Does |
|---|---|
serve | Starts the server and console. The container's default command |
version | Prints the version |
health | Exits 0 if the server answers. The container's health check runs it directly (no shell) |
fingerprint | Prints this install's fingerprint, for a licence request |
doctor [--json] | 3AM Doctor: the running install's health, check by check, with what to do |
preflight [--deep] [--json] | Checks the host, the licence and the reach of every tool. --deep also checks each connector's credentials |
connectors list | Connector kinds in this build, and what each can do |
connectors check | Health of every configured connector |
packs list | The packs your licence opens |
checks run [ALERT …] | Runs the diagnosis for these alerts against live systems, read-only, and prints each cause's verdict |
estate build | Discovers services, repositories, owners and dependencies |
estate resolve ALERT [label=value …] | Which service, repositories and owners an alert belongs to |
knowledge sync | Checks out and indexes the repositories your source connectors list (incremental) |
knowledge search QUERY [--service NAME] | Searches the indexed code and runbooks |
digest [YYYY-MM-DD] | Writes the daily digest for a day |
ledger-verify [DIR] | Verifies the audit log. Exits 1 if anything was changed, removed or reordered |
licence-verify [FILE] | Verifies a licence file offline: its signature, this install, the dates, the revocation list |
Examples
fingerprint
31f196cf0d0cf9897dd29f1efff1244dconnectors list
bitbucket Bitbucket Cloud source
datadog Datadog signal,telemetry
email E-mail approval
git Git server (any) source
github GitHub source
gitlab GitLab source
grafana Grafana telemetry
http Webhooks / runbook automation action
jira Jira ticket
kubernetes Kubernetes signal,action
pagerduty PagerDuty signal,approval
prometheus Prometheus / Alertmanager signal,telemetry,action
servicenow ServiceNow ticket,cmdb
slack Slack approval
splunk Splunk signal,telemetry
sql Database (SQL) action
ssh Servers (SSH) action
symphony Symphony approval
twilio-voice Phone call (Twilio) approval
victoriametrics VictoriaMetrics signal,telemetry,actionchecks run
Diagnose an alert that's firing now, without opening an incident and without changing anything:
3am checks run MySQLReadOnlyconfirmed db_read_only The primary database is in read_only / super_read_only mode; every write
refuted db_connection_exhaustion A client leaks database connections (one user holds many idle sessions),
refuted db_unreachable The database is down or unreachable from the applicationestate resolve
3am estate resolve KubePodCrashLooping namespace=payments workload=checkout-apiledger-verify
{
"ok": true,
"events": 2674,
"segments": 10,
"last_seq": 2674,
"problems": []
}Installer
install.sh, in each release's folder, installs, upgrades and uninstalls 3AM on a server. Run again, it upgrades and
reuses every option from last time. The options: Linux → Options worth knowing,
or ./install.sh --help.
./install.sh # install, or upgrade with the remembered options
./install.sh --openrouter-key-file F # models through OpenRouter
./install.sh --model-url URL --model NAME --s1-url URL # models on your own endpoint
./install.sh --doctor [--json]
./install.sh --forget
./install.sh --uninstall [--purge]Preference learning (3am-dpo)
On a GPU node, from the ml/ package (Learning):
3am-dpo extract --data /var/lib/3am --out pairs.jsonl
3am-dpo train --pairs pairs.jsonl --base /models/llama-3.3-70b --registry /srv/3am-ml --id dpo-2026-10 --by alice --qlora
3am-dpo evaluate --registry /srv/3am-ml --id dpo-2026-10
3am-dpo approve --registry /srv/3am-ml --id dpo-2026-10 --by bob # someone other than the trainer
3am-dpo promote --registry /srv/3am-ml --id dpo-2026-10 --by bob --publish /var/lib/3am/ml/dpoAn adapter is served only after it passes held-out incidents (preference accuracy ≥ 0.6, no regression), is approved by someone other than its trainer, and is promoted through a hash-chained registry log.