Documentation

Overview

A summary of the server — package count, running services, SSL certificates, and cron jobs. Resource gauges show current CPU, memory, disk, and swap usage. The Overview also shows PM2 process status (if configured) with restart counts and memory per process, OOM kill events from the last 24 hours, and baseline deviation count if a baseline has been set.

Packages

Every package installed via apt/dpkg with its version. Use the search box to find specific packages. Version comparison against latest known versions is shown for tracked packages. Pro accounts see versions for apt packages, GitHub releases, and Docker Hub images. Free accounts see apt packages only.

Services

All systemd services with their current status (running, stopped, failed). Filter by status to quickly find failed services. Note: UFW firewall may show as stopped even when active — verify with sudo ufw status on the server.

SSL

SSL certificates detected from your Nginx config, with issuer, expiry date, and days remaining. A color-coded bar shows urgency — green is healthy, yellow is expiring soon, red is critical.

Cron

Scheduled cron jobs from crontab and /etc/cron.d/, showing the user, schedule, and command for each job. The Last Run column shows how long ago each job was last invoked, based on system journal logs from the last 24 hours. Note: Last Run shows when the job started, not whether it succeeded. Jobs showing — have not run in the last 24 hours or could not be matched to a journal entry.

Containers

Docker containers running on the server, showing image name, tag, status, and exposed ports. Containers using the latest tag are highlighted — pinning to a specific version is recommended for production. Note: Docker must be installed before running the agent installer for container detection to work automatically. If you install Docker after the agent, re-run the install command to enable container visibility.

History

A timeline of recent scans for this server. Select any two scans and click Compare to see a diff of what changed between them — packages added or removed, services that changed status, SSL certs, and cron jobs. Use Set baseline to mark the current state as correct, then track deviations from it on the Overview tab.

Changelog

A per-server timeline of documented changes. Log what you changed and why — package updates, config changes, anything worth tracking. The Document this change button auto-fills from detected baseline deviations. All documented changes appear in the unified Activity Feed at /dashboard/changelog.

Server Offline

Fires when a server stops sending scans for 60 minutes. A stale warning fires at 30 minutes.

SSL Expiry

Fires when an SSL certificate is within 14 days of expiry.

Drift Detection

Fires when configuration changes are detected between two consecutive scans — packages added or removed, services changed, cron jobs modified.

Memory Warning

Fires when memory usage stays above the configured threshold (default 82%) for 3 consecutive scans.

Swap Warning

Fires when swap usage stays above the configured threshold (default 50%) for 3 consecutive scans.

Disk Warning

Fires when disk usage on the root partition stays above the configured threshold (default 85%) for 3 consecutive scans.

OOM Kill

Fires immediately when the Linux OOM killer terminates a process on any monitored server.

PM2 Restart

Fires when a PM2 process restarts 3 or more times in a single scan cycle.

Manual entries

Documented changes you log yourself from the Changelog tab on any server. Record what changed and why — useful for audits, troubleshooting, and team communication.

Auto-detected events

Alert events automatically logged when DriftHalt detects something — server offline, drift detected, high memory, OOM kill, PM2 restart, and more. Color-coded by severity.

Filtering

Filter by tab (All / Manual / Auto-detected) or by server. Entries with notes can be expanded to show full details.

Requirements

PM2 installed and running on the server. DriftHalt agent v1.2.3 or later.

Setup

The DriftHalt agent runs as a system user called drifthalt, which has minimal permissions by design. PM2 runs under your personal Linux user account, so the agent cannot access it directly. This setup creates a small helper script that the agent is allowed to call — it runs PM2 as your user and returns process data safely.

Replace YOUR_USERNAME with the Linux user that runs PM2 on your server (commonly ubuntu, deploy, or your personal username).

Creates the helper script that reads PM2 process data:

sudo bash -c 'cat > /usr/local/bin/drifthalt-pm2-info << '\''EOF'\''
                  #!/bin/bash
                  PM2_HOME=/home/YOUR_USERNAME/.pm2 pm2 jlist
                  EOF'
                  sudo chmod +x /usr/local/bin/drifthalt-pm2-info
                  sudo chown YOUR_USERNAME:YOUR_USERNAME /usr/local/bin/drifthalt-pm2-info

Grants the drifthalt agent permission to run the helper script as your user:

echo "drifthalt ALL=(YOUR_USERNAME) NOPASSWD: /usr/local/bin/drifthalt-pm2-info" | sudo tee /etc/sudoers.d/drifthalt-pm2
                  sudo chmod 440 /etc/sudoers.d/drifthalt-pm2

Once complete, PM2 data will appear in your next agent scan (within 15 minutes). No agent restart required.

What gets monitored

Process name and current status. Restart count — alerts when 3 or more restarts occur in a single scan cycle. Memory usage per process.

Alerts

When a PM2 process restarts 3 or more times between scans, DriftHalt sends an email and webhook notification with the process name, restart count, and a link to your dashboard.