Moniqo
Monitoring platform
Features

Context before alerts.

Moniqo understands your server before it starts monitoring. Different servers have different roles, mounts, and critical processes. Generic templates don't work. Context-aware monitoring does.

Discovery-first approach

After installation, the agent collects a complete context snapshot: hardware specs, mount points, running services, filesystem types, storage layout, and capability hints.

You review what was discovered and approve what gets monitored. Nothing runs without your explicit confirmation. No auto-activated alerts you didn't ask for.

Discovery payload preview
Identity
web-prod-01 · Debian 12 · 6.1.0-18-amd64 · bare metal
Hardware
Xeon E-2388G · 16 cores · 64 GB RAM · 2x NVMe
Mounts
/ (ext4, 100GB) · /data (ext4, 1TB) · /tmp (tmpfs)
Services
nginx · php8.2-fpm · mariadb · redis
Capabilities
smartctl mdadm: N/A docker: N/A
Alert examples
Disk will be full soon
backup-srv · /data · 87% used · +2.1 GB/day · full in ~10 days
OOM killer triggered
worker-03 · killed: java (pid 14523) · 2x in last 4 hours
Node stopped reporting
mail-gw · last seen 12 minutes ago · heartbeat timeout
Kernel IO error detected
storage-01 · sdb: I/O error, dev sdb, sector 4194304 · 3x in dmesg

Meaningful alerts only

Disk growth prediction, not just a static threshold. OOM kills, not memory usage percentages. Kernel errors, not load averages. Every alert describes what's actually wrong and why it matters.

We deliberately don't alert on CPU usage, load spikes, or generic memory warnings. These are noise — not signals. Our alerts have a very high signal-to-noise ratio.

Relationships & pairing

Moniqo maps your server room automatically, from the same discovery data the agents already collect — no manual diagramming, no CMDB to maintain:

  • What runs on what — VMs are matched to their hypervisor, so "storage host degraded" immediately shows which guests are at risk.
  • Who mounts what — NFS and CIFS shares are traced from server to every client. When shared storage fills up or stalls, you see every machine it takes down with it.
  • Who talks to whom — live TCP connections between your nodes reveal the real service dependencies, not the ones you think you have.
  • Redundant pairs — two load balancers, two DB replicas. When one leg of a pair degrades, you know before the second one goes down too — Moniqo opens an incident the moment a pair is running without redundancy.

Anything the detection can't see, you can link by hand. The whole map is one click away from any node — and every alert carries this context with it.

Infrastructure map
HW-PRG-01
Bare metal host
Xeon · 128GB
Healthy
VM-APP-02
Symfony app
Pair: VM-APP-03
Running
Services
nginx · php-fpm
mariadb
All running
VM-APP-02 runs on HW-PRG-01 auto
VM-APP-02 mounts /data from storage-nfs auto
VM-APP-02 connects to db-primary:3306 auto
VM-APP-02 paired with VM-APP-03 pair OK

Graceful degradation

Every server gets the monitoring it can support. Old machines aren't left behind — they just get simpler checks.

Basic mode

Old & limited servers

Legacy Linux, minimal tools. Still useful.

  • Heartbeat
  • Disk usage
  • Inode usage
Standard mode

Modern Linux

systemd, proper filesystem, rich discovery data.

  • Everything in Basic
  • Service monitoring
  • dmesg & OOM events
  • Mount classification
Smart mode

Well-readable systems

AI-assisted role detection and smart suggestions.

  • Everything in Standard
  • AI role suggestions
  • Smart mount selection
  • Capability-aware upsell

Capability-aware add-ons

Advanced features are offered only when your server actually has the capabilities. We don't upsell features you can't use.

MegaRAID detected?
Enable RAID health monitoring with controller battery status and rebuild progress.
ZFS pool found?
Monitor pool health, scrub status, and capacity across zpools.
Docker host?
Enable advanced container checks and VM disk growth monitoring.
mdadm array?
Alert on degraded arrays before you lose a second disk.
SMART capable?
Surface disk health hints before catastrophic failure.
Libvirt / KVM host?
Monitor VM guest disk growth from the hypervisor level.

What data we collect — and why

Full transparency: here is everything the agent reads from your server, how often, and what problem each piece of data helps catch. Nothing else leaves the machine.

Open-source, dumb collector
The agent has no logic to hide — it ships raw counters and lets the API do the thinking. Source code published on GitHub at launch.
Counters and culprit names only
When a process is named, it's the name plus a memory or I/O figure. No command lines, no arguments, no environment variables in runtime data.
Never file contents
The agent never reads your files, databases, or the contents of your logs. Metadata about the system, not data on the system.
Every minute
CPU: user / system / iowait / steal
Separates real load from disks dragging the CPU and noisy hypervisors
RAM + top memory consumer (name + RSS)
When memory runs short, we can name the process eating it
Swap usage
Early sign of memory pressure, before things start breaking
PSI pressure-stall (cpu / mem / io)
The kernel's own "things are waiting" metric — catches trouble before usage hits 100%
OOM kill counter
Knows the moment the kernel killed a process for you
Aggregate disk I/O + utilization
Detects saturated disks slowing everything else down
Aggregate network (bytes / packets / errors / drops)
Flags failing NICs and traffic floods
TCP connections (established / time-wait / listen drops)
Connection surges, SYN floods, overloaded listeners
File descriptors
FD exhaustion crashes services in confusing ways
Conntrack usage
A full conntrack table silently drops new connections
Only when needed
Process with the biggest disk I/O
Collected only when disk utilization is ≥ 70% — otherwise /proc is never scanned. When a disk is saturated, we can name the culprit instead of guessing.
Every ~5 minutes
Disk & inode usage
Full-disk warnings and "inodes run out in N days" predictions
systemd service states (incl. enabled/disabled)
Down services, flapping, and services that won't survive a reboot
RAID status (/proc/mdstat)
Degraded arrays, before the second disk dies
Mounts missing from fstab
Mounts that will silently disappear on the next reboot
dmesg kernel events
Hardware and kernel-level failures the metrics can't see
Every hour
SMART disk health (smartctl + vendor RAID tools)
Failing and degrading disks — caught before data loss, not after
At install, then once a day
Discovery snapshot (OS & hardware, mounts, services, listening ports, network interfaces, firewall, top processes, historical dmesg findings)
The context that lets every alert understand what kind of machine it's talking about

What we detect and notify

Every check below exists because it points to a real, actionable problem. If it can't tell you what to do about it, we don't alert on it.

Availability

  • Node down — the server stopped reporting; you hear about it in minutes
  • HTTP / TCP / ping monitors — external checks on your websites and services, from the outside in

Disks & storage

  • Disk filling up — growth-based prediction: "full in ~N days". A stable disk at 90% stays quiet; static thresholds fire only as a last-resort safety net
  • Inodes running out — same idea: "runs out in ~N days" prediction first, hard limits only as the final backstop
  • Filesystem read-only — a mount flipped read-only, often a dying disk
  • RAID degraded — the array lost redundancy
  • Disk failed / degrading — SMART failure or growing error counts
  • Mount missing from /etc/fstab — it won't survive a reboot

Services

  • Service down — a monitored service stopped running
  • Service flapping — repeated restarts, with the probable cause attached
  • Running but disabled — works now, won't start after a reboot

Memory & CPU

  • OOM kill — the kernel killed a process; we name the victim
  • Memory pressure — PSI stall plus the biggest memory consumer
  • CPU steal — an overcommitted hypervisor is stealing your cycles

Disk I/O

  • I/O saturation — a disk ≥ 90% busy for 15 minutes, with the process to blame named in the alert

Kernel signals

Recognized dmesg signatures:

  • NFS stall · disk I/O errors · filesystem errors
  • Segfault · hung task · ECC / RAM errors
  • CPU thermal throttling

Network & security

NIC hardware errors — CRC / frame errors from a failing cable or card
Connection surge — connections at 4× your baseline
SYN flood — half-open connection attack in progress
Packet flood — 5× baseline traffic with suspiciously small packets
File descriptor exhaustion — the system is running out of fds
Conntrack table full — new connections are being silently dropped
Database exposed to the internet — a DB port is listening on a public interface
New listening port — something started accepting connections that wasn't there before
Clock drift — system time is off, which breaks TLS, auth, and logs
OS past end of support — no more security patches for this system

How reports read

No graphs. No dashboards to stare at. A Moniqo report is a sentence that tells you what's happening, why it matters, and what to do about it — and when we know the culprit, we name it. These are real notifications:

web-prod-01 · Service down

Service nginx is not running. It had been running without interruption since 2026-05-02 09:14 UTC (61 days). Check it with: systemctl status nginx

backup-srv · Inodes running out

/var has used 92% of its inodes and at the current rate will run out in about 4 days. There's free disk space, but once inodes are gone no new file can be created and services start failing in confusing ways.

db-01 · OOM kill

The kernel ran out of memory and killed mysqld. The process was using too much RAM (or something else starved it). Check what mysqld was doing and cap its memory or add RAM.

storage-01 · I/O saturation

A disk has been 97% busy for the last 15 minutes — everything waiting on it is slow. The biggest disk user was rsync (210 MB/s).

app-02 · CPU steal

The hypervisor is stealing 23% of this server's CPU time. The VM host is overcommitted — this slowness is not your server's fault.

utility-01 · Won't survive reboot

Service moniqo-agent is running now, but it's disabled — it won't start automatically after a reboot. Enable it with: systemctl enable moniqo-agent

storage-01 · RAID degraded

RAID array md0 is degraded — only 1 of 2 devices are active. The data currently has no redundancy: one more disk failure means data loss.

That's the whole product philosophy. Metrics exist so Moniqo can reason about your servers — you get the conclusion, in plain language, on the channel you already read.

Start with context. End with clarity.

Free for up to 5 nodes. Open source agent. One command to install.