Skip to main content

Services catalog

The agent does not ask what runs on a host. It reports the processes, ports, packages and units it finds, and the matching definitions arrive signed from the platform and start probing within a minute. This catalog is the list of those definitions, one page per service, all written to the same shape so you can find the same answer in the same place:

  • How it is recognised: the facts that match (process, port, package, unit, init system) and how often the probes run.
  • What is collected: the signals in plain words, then the exact metric names that alert rules use, then which logs ship by default.
  • Alerts out of the box: the rules that arrive with the definition, what makes them fire, and why the thresholds are set where they are.
  • Credentials, when the deep probes need one, and the single host-side command that stores it. Credential values never leave the host.
  • Limitations: what is not collected, and what needs a setting on the service side.

Services that rely on the same mechanics share it: web servers link to Websites and domains for the per-site checks, and everything with a log file links to Logs.

Web servers and proxies​

Mail, DNS, FTP​

Queues and brokers​

Containers, virtualization, storage​

The operating system​

Windows​

Host resources (CPU, memory, disk, load, network) are collected on every platform without a definition; their metrics and rules are in the metrics reference and the rules catalog. Network devices polled over SNMP are a module of their own: Devices.

How a definition works​

A definition is a signed document that says which facts must match and which probes to run. Probes are built from a small set of primitives executed on the host:

  • exec: run one allow-listed binary with fixed arguments, no shell, and parse the output.
  • http(s): call a local endpoint and parse JSON, a Prometheus exposition or a regex, with basic, bearer or header authentication from a named credential.
  • sql: run a read-only query over the driver (MySQL, PostgreSQL, MSSQL, Redis) and map columns to metrics. Passwords never appear on a command line.
  • file: read a file, match content, report its age or hash it for integrity.
  • tcp: connect to a local port and check it accepts connections.
  • logtail and journal: follow a log file or the systemd journal from a saved position and count patterns into rates. Only new lines are read.
  • snmp: GET and WALK devices from a collector host.

For the few services that cannot be expressed this way (Docker, Kubernetes, DRBD, LINSTOR, Proxmox, libvirt, Hyper-V, IIS, HAProxy, keepalived, PHP-FPM pools), the probe is compiled into the agent and the definition only switches it on.

Two things hold for every definition. Nothing runs that was not signed: official definitions carry the publisher signature baked into the agent, and templates you write or install from the marketplace carry your workspace's own signature and live in their own namespace. And a definition stops matching the moment its service stops running, which is why "is it running" signals come from a package or unit check rather than from the process itself. See Signed definitions.

One rule shared by all services​

Every service is covered by the rule monitoring cannot collect from a service: when a service's probes have not produced a single successful check for six hours, an incident opens. Every other rule watches a metric, and a service whose probes stopped working produces none, so without this rule a broken probe would look exactly like a healthy service. Restarts, config moves and reboots never come close to six hours.

Billing units​

A monitored site (an nginx or Apache vhost, an IIS site) is one unit. Containers are grouped by image, so ten containers of one image count once. An agentless SNMP device is one unit regardless of its port or sensor count. What each unit costs is on the pricing page.