Linux server monitoring

What it reports

• Health: load, memory, swap, disk space, uptime, and whether a reboot is waiting.
• Services: the systemd services you name, plus any that have failed.
• SSH sign-ins: failures, successes, where they came from, and a success straight after repeated failures.
• Updates and backups: how many updates are pending, and how old the newest file is in a backup folder you name.
• Changes: fingerprints of /etc/passwd, /etc/sudoers and authorized_keys, so a change shows without us holding the files.
• Countries: which countries the attempts come from. It's country level, and it depends on a lookup table being loaded on our side.

You get an alert for a disk filling up, a watched service stopping, a suspicious sign-in, a stale backup, or security updates waiting. A few alerts, such as a changed file fingerprint or a new listening service, come to me first, because they're usually someone's own deploy.

Ports: what's really there

Two separate things, and neither is general port monitoring.

• Listening sockets. The agent reports which TCP and UDP sockets are listening on the server, leaving out loopback. It's a fixed list that you can't configure, and you can't browse it in the panel yet. Its only visible effect is an alert when a new one appears, and that alert comes to me. A port closing raises nothing.
• TCP connect checks. For the ports you list on a server (22, 80 and 443 by default), our panel tries to connect from our address. That can raise an alert if a port is closed while another is open, and a critical one if they're all closed. A port firewalled from the internet reads as closed.

UDP isn't monitored. It only appears in the agent's listening report.

Traffic: what it means here

Web requests from your access log, and only if you switch that on for the server. It reads nginx or Apache combined logs and reports requests, status codes, top paths and addresses, browser family and bytes sent. There are no network card or bandwidth counters.

Logs it can read

Three fixed sources, no others:

• SSH sign-ins from /var/log/auth.log or /var/log/secure.
• The web access log, if you switch it on.
• MySQL's running queries and slow log, if you switch them on. MySQL only.

What it sends about people

• SSH account names and source addresses. A name SSH says doesn't exist is masked by default, because people sometimes type a password there.
• If you switch on web logs: your visitors' IP addresses, paths, browsers and referrers in sample lines. Query strings are removed. Your visitors didn't sign up with me, so leave this off unless you need it.
• If you switch on MySQL: query text, which can contain data from your database.

How long each is kept is on the privacy page.

Installing it

• It needs systemd and Python 3, with nothing else to install.
• You install it yourself with one curl command piped to sudo bash, using a token just for that server. Read the script first if you'd like to.
• It runs as root, on a systemd timer. It keeps one small state file, and it never accepts a connection.
• Run it with --dry-run and it prints the report without sending anything.
• The installer lists how to remove it, and it's a few files and a timer.

What this isn't

• It doesn't block attacks or stop anything. It's not a firewall.
• It doesn't read arbitrary log files, and it doesn't watch databases other than MySQL.
• It doesn't fix anything on its own. Fix work is separate and quoted per job.

The free trial is for one website. Server monitoring is a paid plan. A late payment pauses server monitoring and log collection until it's paid, and nothing is deleted.

Website monitoring How the website checks work