Skip to main content

Service catalog

When a host matches a service definition, the agent runs that service's probes and turns the output into svc.<service>.* metrics and inventory facts. The catalog is maintained on the server and signed, so new services appear without an agent update.

Probe primitives​

Definitions are built from a small set of primitives, executed locally:

  • exec: run an allow-listed binary (no shell) and parse the output with regex.
  • http(s): call an endpoint, parse JSON or regex, with basic, bearer, or header auth.
  • sql: run a query and map columns to metrics (MySQL, PostgreSQL, Redis, MSSQL).
  • file: read a file, match content, optionally hash it or report its age.
  • tcp / udp: connect and check a banner or health.
  • logtail: follow a log from a saved offset (handles rotation), count patterns into rate metrics.
  • journal: read new systemd journal entries by cursor, no shell.
  • snmp: GET and WALK, v1, v2c and v3, mapping OIDs to dev.* metrics.
  • procstat, prom, and a few more for process stats and Prometheus endpoints.

For the small share of services that cannot be expressed this way, a compiled Go fallback probe is built into the agent (for example keepalived, libvirt, HAProxy, Proxmox).

What is covered today​

The live catalog includes web servers (nginx, Apache including vhosts and per-vhost SSL), databases (MySQL and MariaDB, PostgreSQL, Redis, MongoDB, MSSQL), mail (Postfix, Dovecot, Exim, and Proxmox Mail Gateway with spam, virus, RBL and ClamAV-freshness metrics), DNS (BIND, PowerDNS, Unbound), queues and brokers (RabbitMQ, Kafka, NATS), load balancers and proxies (HAProxy, keepalived, Varnish, Traefik), virtualization (KVM/libvirt, Hyper-V, Proxmox), containers (Docker, grouped by image), and Windows IIS and MSSQL.

Billing unit note​

A monitored site (an nginx or Apache vhost, an IIS site) is one billing unit. Containers are grouped by image, so N containers of one image count as one service, not N. An agentless SNMP device is one unit regardless of how many ports or sensors it has.

Vhosts and SSL​

The vhosts probe parses nginx -T or apache2ctl -S, registers each vhost as a vhost inventory fact, and runs a per-vhost HTTP check using the Host header against loopback. For HTTPS it detects SSL by a TLS handshake sniff (config heuristics lie) and reports ssl_days_left and whether the chain is trusted, with browser-like notes for self-signed, untrusted, or expired certificates.

Community and unsigned definitions​

Planned

The catalog is designed as two tiers: official signed definitions (built today, may auto-apply on match) and a community or unsigned tier that would run only after explicit per-host operator approval, with a preview of the exact command, query, or file before the first run. Only the signed tier exists today. The agent rejects anything that is not publisher-signed. The unsigned tier, the per-host approval, and the preview are planned and arrive with the console.