Linux servers#

Monitors CPU, memory, disk, filesystem, network, processes and logs on any Linux host. The agent is an OpenTelemetry collector with a configuration ObserveIQ generates for you.

Supported distributions#

Debian and Ubuntu, RHEL, CentOS, Rocky and AlmaLinux, Amazon Linux 2 and 2023, and SUSE. Both x86_64 and arm64. Requires systemd and outbound HTTPS on port 443.

Install#

export OBSERVEIQ_API_KEY="obs_your_key_here"
export OBSERVEIQ_ENDPOINT="https://app.observeiq.io"

curl -fsSL "$OBSERVEIQ_ENDPOINT/api/v1/docs/vm-agent.sh" | sudo -E bash

The script detects the distribution and architecture, installs the collector to /opt/observeiq-agent, writes /etc/observeiq/agent.yaml, installs a systemd unit and starts it.

Add a hostname label if the machine's own hostname is not meaningful:

curl -fsSL "$OBSERVEIQ_ENDPOINT/api/v1/docs/vm-agent.sh" | sudo -E bash -s -- \
  --hostname web-prod-01 --env production --tags "role=web,team=platform"

Verify#

systemctl status observeiq-agent
journalctl -u observeiq-agent -n 50 --no-pager

The host appears under Infrastructure → Hosts within about a minute.

Note

If the host does not appear, the usual cause is egress filtering. Confirm the machine can reach the endpoint: curl -sSf https://app.observeiq.io/api/v1/health.

What is collected#

Group	Metrics
CPU	Utilisation per core and total, load average, steal and iowait
Memory	Used, available, cached, buffers, swap
Disk	Read and write throughput, IOPS, latency, queue depth
Filesystem	Used and free bytes and inodes per mount
Network	Bytes and packets per interface, errors, drops
Processes	Count by state, top consumers by CPU and memory
Uptime	Boot time and time since boot

Collecting log files#

Edit /etc/observeiq/agent.yaml and add paths under filelog:

receivers:
  filelog:
    include:
      - /var/log/syslog
      - /var/log/nginx/*.log
      - /opt/myapp/logs/*.log
    exclude:
      - /var/log/*.gz
    operators:
      - type: regex_parser
        regex: '^(?P<time>\S+ \S+) (?P<sev>\w+) (?P<msg>.*)$'
        timestamp:
          parse_from: attributes.time
          layout: '%Y-%m-%d %H:%M:%S'

Then restart:

sudo systemctl restart observeiq-agent

Warning

The agent runs as its own user. If it cannot read a log file the entry is skipped silently. Either add the observeiq user to the owning group, or set the file mode. Check with sudo -u observeiq head -1 /path/to/file.

Rolling out at scale#

The installer is idempotent and safe to run from configuration management. For Ansible:

- name: Install ObserveIQ agent
  ansible.builtin.shell: |
    curl -fsSL "{{ observeiq_endpoint }}/api/v1/docs/vm-agent.sh" | bash -s -- \
      --hostname {{ inventory_hostname }} --env {{ env }}
  environment:
    OBSERVEIQ_API_KEY: "{{ observeiq_api_key }}"
  args:
    creates: /etc/observeiq/agent.yaml

Use a dedicated API key for host installation so it can be rotated independently of application keys.

Uninstall#

sudo systemctl disable --now observeiq-agent
sudo rm -rf /opt/observeiq-agent /etc/observeiq /etc/systemd/system/observeiq-agent.service
sudo systemctl daemon-reload