Skip to main content

What gets monitored

The agent collects several layers, from always-on base metrics to opt-in deep APM. Most of it activates by matching, not configuration: the agent reports host facts, the server pushes the definitions that match, and those probes start.

Base host metrics (always on)​

CPU, memory, disk, load, network, and uptime, on every platform. These come from platform sources chosen at startup by OS and need no privilege beyond reading /proc (or the equivalent WinAPI and macOS calls). Collection interval is server-controlled, typically 60 seconds in production.

The layers​

  • Auto-discovery. Processes, ports, packages, units, init system, cron jobs. This is the fact base everything else matches against. See Discovery.
  • Service probes. The catalog: nginx, Apache, databases, mail, DNS, queues, load balancers, virtualization, Windows IIS and MSSQL, and more. See Service catalog.
  • APM. Per-transaction traces and CPU flamegraphs for PHP and .NET, in three depths. See APM.
  • SNMP and network. Agentless polling of routers, switches, UPS and other devices through a collector role. See SNMP and network.
  • Host security. SSH brute-force rate, file integrity monitoring, open ports. See Host security.
  • Patch, backup, cron. Pending updates and CVEs, backup freshness, scheduled job health. See Patch, backup, cron.

Metric naming​

Metric names follow a fixed scheme. Dimensions go into tags, never into the name.

  • host.* for base host metrics,
  • svc.<service>.* for service probes,
  • ext.* for external and synthetic checks,
  • dev.* for SNMP devices.

On-agent anomalies​

The agent scores each metric series against a local baseline (an exponentially weighted moving average and variance) and raises an anomaly event when a series deviates strongly and stays there. This runs on the agent, so it works even on the free baseline tier with no server cost.

Offline buffering​

If the server is unreachable, the agent spools metrics to a disk-backed ring buffer, bounded by size and age, and replays them on reconnect. A dead link is detected within about 30 seconds by a WebSocket ping before each heartbeat, so a silently blackholed connection does not lose data quietly.