WatchSSH GitHub

Open-source infrastructure monitoring

WatchSSH

Monitor your SSH fleet. Install nothing on the servers.

WatchSSH runs centrally, connects to many targets over SSH, executes core system tools already available on each host, and turns their output into useful operational signal.

Explore on GitHub Quick start

go run .Starts the dashboard on localhost:8080

Zero agentsNothing to install on targets

One monitorConnect to many SSH servers

Native toolsUse the utilities hosts already have

Cross-platformLinux, macOS, BSD, Windows

One process, many targets

Monitor the fleet without modifying the fleet.

Point one WatchSSH process at the servers you already manage. It reuses SSH access, runs familiar operating-system utilities remotely, and gathers host telemetry without an agent, daemon, or package rollout on every target.

01

Collect over SSH

WatchSSH connects to each configured server and runs core system utilities, including coreutils and platform equivalents, to collect CPU, memory, disks, load, processes, users, and network counters.

02

No target-side rollout

No agent process, service unit, package, or database needs to live on the monitored server. SSH is the only required transport.

03

See the wider picture

Add Docker metrics, external probes, a built-in dashboard, tinySQL history, Prometheus export, email alerts, and guarded actions.

Probe from the monitoring host

Measure more than SSH availability.

External probes are repeatable, alertable, and included in the JSON and Prometheus outputs. Use them to distinguish an unreachable host from a broken service, resolver, route, certificate, or clock.

Read the probe reference
ICMP
Reachability and average latency
TCP
Port state, connection latency, error detail
HTTP
Method, status, body match, response time
DNS
A, AAAA, CNAME, MX, TXT, and expected answers
TLS
Handshake, certificate identity, and expiry
NTP
Stratum, latency, and clock offset
Trace
Path reachability and observed hop count

A useful fit for mixed fleets

From cloud instances to the small machines that run the edge.

WatchSSH selects platform-aware collectors for Linux, macOS, FreeBSD, OpenBSD, NetBSD, generic Unix, and Windows over OpenSSH. It relies on familiar built-in tools and conservative fallbacks rather than a target-side agent. Raspberry Pi and compatible SBCs add board temperature, CPU frequency, Wi-Fi RSSI, throttling, and under-voltage diagnostics.

LinuxmacOSFreeBSDOpenBSDNetBSDWindowsRaspberry Pi

Built for lean IT teams

Operational visibility without another agent rollout.

Run WatchSSH on one managed internal host and use the SSH accounts and host-key controls you already operate. It is a practical fit for a small team responsible for a mixed fleet, not a replacement for every enterprise observability system.

  • Bounded by designSet worker limits and timeouts to protect the monitoring host and target connection limits.
  • Secure access pathsUse verified host keys, a dedicated monitoring account, bcrypt dashboard authentication, and TLS through your reverse proxy.
  • Fits existing workflowsKeep local history, export Prometheus metrics, send email alerts, or trigger a guarded local action.

A direct operating model

Configure, observe, export.

  1. 1

    List your servers

    Declare hosts and reuse their existing SSH access with strict host key verification.

  2. 2

    Collect remotely

    WatchSSH runs standard utilities on each target and gathers the metrics centrally.

  3. 3

    Act on signal

    Use the dashboard, history, Prometheus endpoint, email, or a guarded action.

WatchSSH

Start monitoring with the SSH access you already have.

Get WatchSSH on GitHub