Linux Server Monitoring System - Stealth Local Setup

A completely self-hosted, stealth server monitoring solution with ZERO cloud dependencies. All data stays on your infrastructure.

Features

Fully Local & Private

• No Cloud Services: Everything runs on your own hardware
• SQLite Database: Lightweight, file-based database
• Local API Server: Node.js/Express backend
• Complete Privacy: Your data never leaves your network
• Stealth Mode: No external connections or dependencies

Monitoring Capabilities

• Real-time metrics (CPU, Memory, Disk, Network)
• System logs collection and analysis
• Alert system with configurable thresholds
• Remote command execution
• Security event monitoring
• Multi-server management

Architecture

┌─────────────────┐
│  Web Dashboard  │  (React - Port 5173)
│   localhost     │
└────────┬────────┘
         │
┌────────▼────────┐
│   API Server    │  (Express - Port 3001)
│   localhost     │
└────────┬────────┘
         │
┌────────▼────────┐
│ SQLite Database │  (monitoring.db)
│  Local Storage  │
└────────┬────────┘
         │
┌────────▼────────┐
│ Monitored       │  (Python Agents)
│ Servers         │  Send metrics to API
└─────────────────┘

Quick Start

Prerequisites

• Node.js 18+ and npm
• Python 3.7+ (for agents on monitored servers)
• Linux or macOS (Windows works with WSL)

Installation

1. Run the setup script:

   chmod +x setup.sh
   ./setup.sh

2. Start the system:

   chmod +x start.sh
   ./start.sh

3. Access the dashboard:

   • Open http://localhost:5173 in your browser

That's it! The monitoring system is now running locally.

Manual Setup (Alternative)

If you prefer manual setup:

1. Install Dependencies

npm install
cd server
npm install
cd ..

2. Initialize Database

cd server
npm run init-db
cd ..

3. Start Backend

cd server
npm start

The backend will run on http://localhost:3001

4. Start Frontend (in new terminal)

npm run dev

The dashboard will be available at http://localhost:5173

Adding Servers to Monitor

Step 1: Add Server in Dashboard

1. Click "Add Server" button

2. Enter server details:

   • Name: Friendly name (e.g., "Production Server 1")
   • Hostname: Server hostname
   • IP Address: Server IP address
   • OS Version: Operating system (e.g., "Ubuntu 22.04")

3. Copy the Server ID displayed after adding

Step 2: Deploy Agent on Target Server

1. Copy the agent script:

   scp agent/server-agent.py user@target-server:/opt/

2. Install dependencies on target server:

   ssh user@target-server
   sudo apt update
   sudo apt install python3 python3-pip -y
   pip3 install requests psutil

3. Configure the agent:

   nano /opt/server-agent.py

   Update these lines:

   API_URL = "http://YOUR_MONITORING_SERVER_IP:3001/api"
   SERVER_ID = "YOUR_SERVER_ID_FROM_DASHBOARD"

4. Test the agent:

   python3 /opt/server-agent.py

5. Setup automatic monitoring (optional):

   crontab -e

   Add this line to run every minute:

   */1 * * * * /usr/bin/python3 /opt/server-agent.py >> /var/log/server-agent.log 2>&1
   

Configuration

Backend Configuration

Edit server/server.js to customize:

• Port (default: 3001)
• Database location
• CORS settings

Frontend Configuration

Edit .env.local:

VITE_API_URL=http://localhost:3001/api

Change the URL if running on a different machine.

Agent Configuration

Edit agent/server-agent.py:

API_URL = "http://your-server-ip:3001/api"
SERVER_ID = "server-id-from-dashboard"

Security Recommendations

1. Firewall Configuration

Only allow access to port 3001 from your monitored servers:

sudo ufw allow from 192.168.1.0/24 to any port 3001
sudo ufw deny 3001

2. Use HTTPS (Production)

For production, setup a reverse proxy with SSL:

server {
    listen 443 ssl;
    server_name monitor.yourdomain.local;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    location / {
        proxy_pass http://localhost:5173;
    }

    location /api {
        proxy_pass http://localhost:3001;
    }
}

3. Authentication (Optional)

Add basic authentication to the backend by modifying server/server.js:

app.use((req, res, next) => {
    const auth = req.headers.authorization;
    if (!auth || auth !== 'Bearer YOUR_SECRET_TOKEN') {
        return res.status(401).json({ error: 'Unauthorized' });
    }
    next();
});

4. Network Isolation

Run the monitoring system on an isolated management network separate from production.

Database Management

Backup

cp server/monitoring.db server/monitoring.db.backup

View Data

cd server
sqlite3 monitoring.db

Example queries:

SELECT * FROM servers;
SELECT * FROM metrics ORDER BY timestamp DESC LIMIT 10;
SELECT * FROM alerts WHERE is_active = 1;

Reset Database

cd server
rm monitoring.db
npm run init-db

Troubleshooting

Backend Won't Start

cd server
rm -rf node_modules
npm install
npm start

Database Errors

cd server
rm monitoring.db
npm run init-db

Agent Can't Connect

1. Check firewall allows port 3001
2. Verify API_URL in agent is correct
3. Test connectivity:

   curl http://YOUR_SERVER_IP:3001/api/servers

Dashboard Not Loading Data

1. Check browser console for errors
2. Verify backend is running (http://localhost:3001/api/servers)
3. Check .env.local has correct API URL

Production Deployment

Run as System Service

Create /etc/systemd/system/monitor-backend.service:

[Unit]
Description=Server Monitoring Backend
After=network.target

[Service]
Type=simple
User=monitor
WorkingDirectory=/opt/monitoring/server
ExecStart=/usr/bin/node server.js
Restart=always

[Install]
WantedBy=multi-user.target

Enable and start:

sudo systemctl enable monitor-backend
sudo systemctl start monitor-backend

Build Frontend for Production

npm run build

Serve the dist folder with nginx or any web server.

Performance

• Database: SQLite handles 100+ servers easily
• Memory: Backend uses ~50MB RAM
• CPU: Minimal (<1% on modern hardware)
• Storage: ~10MB per server per month (metrics)

Data Retention

Edit server/server.js to add automatic cleanup:

setInterval(() => {
    db.prepare('DELETE FROM metrics WHERE timestamp < datetime("now", "-7 days")').run();
    db.prepare('DELETE FROM logs WHERE timestamp < datetime("now", "-30 days")').run();
}, 86400000);

Advanced Features

Custom Alerts

Add alerts directly to database:

INSERT INTO alerts (id, server_id, type, severity, condition, threshold, message, is_active)
VALUES (
    hex(randomblob(16)),
    'YOUR_SERVER_ID',
    'cpu',
    'warning',
    'CPU usage exceeds threshold',
    80,
    'CPU usage is above 80%',
    1
);

API Endpoints

All endpoints available at http://localhost:3001/api:

• GET /servers - List all servers
• POST /servers - Add new server
• DELETE /servers?id=ID - Remove server
• GET /metrics?server_id=ID&limit=100 - Get metrics
• POST /metrics - Submit metrics
• GET /commands?server_id=ID - Get commands
• POST /commands - Create command
• PUT /commands - Update command
• GET /logs?server_id=ID - Get logs
• GET /alerts?server_id=ID - Get alerts
• PUT /alerts/:id/resolve - Resolve alert
• GET /security-events?server_id=ID - Get security events
• PUT /security-events/:id/resolve - Resolve event

Support

This is a self-hosted solution. All code is open and available for inspection and modification.

License

MIT - Use freely for personal and commercial purposes.