Server monitoring

Agent-based monitoring starts with installing the agent. Once it reports in, the host appears under Servers with metrics, inventory, and - on Linux - the eBPF security stream. This page covers the monitoring side; security is under Security events.

Agent hosts are included on Professional (5) and Business (25), and on the trial; the Free plan is agentless. See Plans and billing.

What the agent collects

Check	Linux	Windows	Interval	What it reports
CPU	yes	yes	30s	user, system, nice, idle, iowait, steal as percentages
Memory	yes	yes	30s	used, free, and percentage
Load average	yes	no	30s	1, 5, and 15 minute load
Disk usage	yes	yes	60s	per filesystem: total, used, free, percent, mount point, type, device
Processes	yes	yes	30s	whether a named process is running, PID count, CPU and RSS
Ports	yes	yes	60s	listening ports, with opened and closed events
Services	yes	yes	60s	systemd or Windows service state, with started, stopped, and failed events
Docker	yes	no	30s	every container’s state, health, and resource use; see Docker monitoring
Packages	yes	yes	5 min	installed package inventory
HTTP	yes	yes	30s	a URL checked from the host itself, for services not reachable from outside
DNS	yes	yes	-	a resolution check from the host
SSH	yes	-	-	session tracking; see SSH login monitoring

Intervals are the defaults and can be changed per check. Network throughput is not collected; network data is inventory - addresses and listening ports - shown on the Network tab.

The agent also sends a heartbeat every 10 seconds over its connection, which is what decides online and offline.

The server page

Open a host under Servers to see its tabs: Metrics, Agent, Packages, Services, Network, Checks, Alerts, Docker, and AI Assistant.

Metrics renders one chart per metric group - Agent Ping, Load Average, Memory Usage, CPU Usage, Docker, Services, Packages, and one per HTTP check - over 1 hour to 1 month. Charts carry threshold bands: green below 70 percent, amber from 70 to 90, red above 90 (for load average, relative to the core count). Any chart expands to full width. Data is kept for the plan’s retention window; longer ranges are served from 5 minute and hourly rollups.

Agent shows the agent’s status, ID, version, install time, and the security module’s state and features, with actions to install, update, or restart the agent. Checks lists which check profiles apply and every check with its period, and is where per-host checks are added or disabled. Alerts lists this host’s alerts.

The host’s label and escalation policy are editable from the header. Alerts raised for this host route to that policy, or to the workspace default when none is set.

Check profiles

A check profile is a named bundle of checks with their settings, applied to hosts. Servers, then Check Profiles lists them. Every workspace is seeded with:

• Default Linux Profile: memory, CPU, disk usage, load average, port monitoring (detect changes, alert on new and closed ports), and Docker. Attached automatically to every new host.
• Default Windows Profile: memory, CPU, disk usage, and port monitoring. Swapped in automatically when the install command is generated for a Windows host; load average and Docker do not exist on Windows.
• MySQL, PostgreSQL, MongoDB, Redis, Kafka, RabbitMQ, Elasticsearch: port, process, and HTTP checks for each service, to add on top of the OS profile.

Create your own for a fleet role - “web tier”, “batch workers” - and assign it on the host’s Checks tab. A host can carry several profiles; the metric groups on its page are rebuilt from the union.

Per-host checks

The Checks tab also takes checks that apply to one host only: a process that must be running on this box, an HTTP endpoint only it serves, a port that should never be open. Each has a name, type, period, timeout, and type-specific details, and can be disabled without being deleted. Profile checks can be disabled per host the same way.

Thresholds

CPU, memory, disk, and load checks carry Warning Threshold (%) and Critical Threshold (%) fields, seeded at 80 and 90. Today those values are recorded on the profile and drive the chart bands; they do not raise alerts by themselves. Threshold alerting on host metrics is on the roadmap. What does raise alerts is listed next.

What pages, and what is recorded

Two things on a host raise alerts that go to its escalation policy:

Condition	Where it comes from
Host offline	No heartbeat for the host’s offline window (default 5 minutes). Per host, alert_for_offline and max_offline_seconds are settable over the API, so a machine that sleeps at night does not page anyone.
Security detections	eBPF rules at or above the alert bridge’s minimum severity; see eBPF security monitoring

Everything else the checks notice is recorded as a host event on the Agent tab’s timeline, with a priority, and is read by Kicker as context during triage: listening ports opened or closed, services started, stopped, or failed, a watched process stopping, containers starting, stopping, or dying, a required container missing, and package changes. Those events do not page by themselves today. To be paged when a service on the host is down, put an HTTP or TCP monitor on what it serves, or a heartbeat inside the job - both route to an escalation policy. Host alerts behave like any other alert: see Working with alerts.

Host status

Status	Meaning
nocheckin	Added in the dashboard, agent not yet reporting
online	Heartbeats arriving
offline	Heartbeats stopped for longer than the offline window

A host that stays nocheckin after an install usually cannot reach the endpoint: the agent needs outbound TCP to port 8585 on the endpoint named in its install command. See Install the agent for the verification steps.

Updating agents

The Agent tab offers Update agent for one host. Servers has a rolling update for the fleet, which queues hosts one after another and can be told to stop the rollout if an update fails. Updates are pushed over the agent’s connection: the agent downloads the package, verifies its checksum, swaps itself in, and reports progress. Nothing needs to be run on the host.

Windows hosts

The same server page, checks, and profiles apply to Windows, with the differences listed above and no eBPF module. Security telemetry on Windows comes from the Event Log and Sysmon instead. See Install on Windows.

Next steps

• Docker monitoring
• Services and topology to group hosts into the things they serve
• Escalation policies for where host alerts go