Patch, backup, cron
Three operational signals that matter for hosting and compliance.
Pending updates and CVEs
The agent reports how many package updates are pending and how many are security updates,
across package managers. There is one shared service name os with a definition per
manager: apt, dnf, dnf5, zypper, apk. On the RHEL family it also reports pending CVE counts
and a severity breakdown (critical, important, moderate, low), because that data is
available locally there. A reboot-required flag is reported where the distribution
exposes it.
Cross-distribution CVE correlation for the whole fleet (matching the package inventory against an external vulnerability database on the server side) is planned. The agent itself never calls an external feed, keeping the finance-clean "only the control plane talks to the outside" property. The RHEL-local CVE counts above are live.
Backup freshness
The file probe reports the age of a backup artifact or repository, so you can alert when
a backup has not run. For a directory it uses the newest entry, which handles borg and
restic repositories that mutate a subdirectory per run. Definitions exist for a generic
backup path (activated only when you point it with wakora --set backup.path=..., silent
otherwise) and for borg and restic (matched by package, reporting the tool version and the
repository age).
The passive "job ran" ping endpoint and the alert when a backup or job is silent past its window live on the server. The agent side (reporting the artifact age and the cron inventory) is live.
Cron and scheduled jobs
Discovery enumerates cron entries into inventory (kind=cronjob): the system crontab,
cron.d, per-user spools, and the cron.hourly through cron.monthly directories, keyed
by user and command with the schedule. The cron and crond definitions also turn cron
run and error rates into metrics from the journal.
Predictive: disk full forecast
The server forecasts when a disk will fill. It runs a linear regression over a week of
host.disk.used_pct per mount, and when the trend points at a full disk within the
threshold window it raises a disk_full_forecast insight with the mount, the current
percentage, the daily slope, and the estimated days left.
Domain expiry
A domain probe reports days until a domain registration expires, using RDAP first (the
ICANN JSON standard) and a WHOIS fallback. It covers gTLDs well. Some ccTLDs do not publish
an expiry at all, in which case you see an explicit "expiry not found" rather than a wrong
value.
Email deliverability
Deliverability checks for your mail domains (RBL and blocklist status, SPF, DKIM, DMARC, and a delivery test) are planned. They run against Wakora's own mail infrastructure. The mail server probes in the service catalog (queue depth, deferred and bounced rates, auth failures) are live today.