Linux server monitoring

The agent is a single static binary with no runtime dependencies, installed as a systemd unit on most distributions and as an OpenRC service on Alpine. It builds for amd64, arm64 and 386, which covers everything from a cloud instance to an old box in a cupboard.

What it costs

This is the part that matters on a busy server. The agent takes one snapshot per tick from /proc and /sys in a single goroutine. It does not spawn a process per metric - the pattern that makes shell-based collectors expensive under load. Costly collectors (package updates, SMART, Docker inventory, hardware facts) run on their own long intervals, not every tick.

Network probes - uptime, TLS expiry, ping - run on the panel rather than the agent, so adding them costs the monitored host nothing.

What is worth watching on Linux

• Failed systemd units. Like stopped Windows services, a binary condition worth paging on.
• Disk fill rate, not just disk usage. A capacity forecast gives you weeks of warning instead of a threshold crossing at 3am.
• SSH authentication. Detected on the host, in seconds, with the top source addresses reported.
• Available updates and reboot-required, so a fleet-wide patch state is visible without logging in anywhere.
• SMART and RAID on bare metal, where a degrading disk is the failure you most want early warning of.
• Listening ports and new users, which catch configuration drift and unauthorised access.

Installation

curl -fsSL https://panel.example.com/install.sh | bash -s -- \
  --token <ENROLLMENT_TOKEN> --panel panel.example.com

The script detects the distribution and architecture, installs the service, and enrolls over mutual TLS. See installing the agent for what enrollment does and how to upgrade or remove it.