Blog

Notes from building a monitoring platform - how we decide what to measure, what to alert on, and what to leave alone.

• What a server health score should actually measureA single number per host is only useful if it changes when something is wrong and stays still when nothing is. Here is how we decide what goes into it.2026-07-14
• Catching an SSH or RDP brute force in seconds, not on the next pollWhy password-guessing attacks have to be detected on the host rather than inferred from metrics on the server, and what that changes.2026-06-02
• Forecasting when a disk will fill, and when not to botherLinear regression on disk usage is enough to catch most capacity problems weeks early - provided you are honest about the cases where it is meaningless.2026-05-08