Servers
The servers list, the settings of each server, and the server details page.
A server is a machine that runs the agent. To add one, see Install the agents.
The servers list
Servers lists every registered server, by group, with its status, note, operating system, IP, agent version and last report. "Alerts off" marks a server whose alerts are turned off. Each row has these buttons:
| Button | What it does |
|---|---|
| Settings | Opens the server's settings (below) |
| ⋯ → Install command | Shows the server's install command again, and the 3rmonitor bind command to re-enroll an agent that is already installed |
| ⋯ → Details | Opens the server details |
| ⋯ → Delete | Deletes the server and its history. Its agent is no longer allowed to report. |
The IP shown is the public address. Next to it, a private address appears as "LAN …".
＋ Add server at the top registers a new server, and Enroll many servers with one command at the bottom manages the enrollment key. See Install the agents.
Server settings
Click Settings on a server's row, change what you need, and click Save.
General
| Field | What it does |
|---|---|
| Name, Group | How the server is shown and grouped. A group can have its own alert recipients. |
| Note | Up to 60 characters, shown on map labels, in lists and on the details page, for example "Main site · AWS" |
| Displayed IP | The IP to show. Empty = automatic, public IP first. |
| Order | Position in lists (smaller first) |
| Enable alerts | When off, no alerts are raised or emailed for this server: it is still shown and keeps its history. Useful for test servers or during maintenance. |
Thresholds
Empty uses the default from Settings; -1 turns that check off for this server.
| Field | Default | Meaning |
|---|---|---|
| CPU %, Memory % | 90 | Alert when above this for longer than Seconds before alerting |
| Seconds before alerting | 120 | How long CPU or memory must stay above the threshold |
| Disk % | 90 | Alert when any partition is fuller than this |
| Offline after (s) | 30 | No report for this long = offline |
| Service failures in a row | 3 | How many bad reports in a row before a service alert |
| Report interval (s) | 3 | How often the agent reports. Smaller = closer to real time, but more traffic (see Bandwidth usage). |
Traffic usage and quota
| Field | What it does |
|---|---|
| Count traffic on | All network interfaces (default: every real interface, not loopback or container interfaces), or one interface, for example only the public one if internal traffic is free. The list shows the interfaces of the last report, with their addresses. |
| Monthly quota (GB) | The server's traffic plan, for example 1000. Empty = No quota. 1 GB here is 1024³ bytes. You get an alert at 80% and at 100%. |
| Quota counts | download + upload (default), upload only, download only, or the larger of download and upload: use what your provider bills |
| Resets on day | The day of the month the quota starts again, 1 to 28 (default 1) |
See Traffic usage.
Map location
Automatic (from IP / time zone) places the server by the country of its public IP, otherwise by its time zone; the agent on the master itself uses the master's location. To place it exactly, choose a city or Custom coordinates…. See Server map.
Blocklist / allowlist and vulnerability checks
- Enforce the blocklist / allowlist with the firewall on this server (needs nftables, or ipset + iptables): turns blocking on for this server. See Traffic and blocklist.
- Project directories: one per line. The vulnerability checks find
composer.lockandpackage-lock.jsonin the usual web directories by themselves; add projects in other locations here, for example/data/sites/shop.
AI on-call
- Never let the AI run anything on this server (not even read-only diagnostics): excludes this server from AI on-call. The AI still sees its monitoring data.
- Networks the AI sandbox may reach: one per line, for example
10.0.0.0/24. Empty = only this server. Diagnostic scripts always reach the server itself; other networks only withinsandbox_networks_maxin the server'sagent.conf(private networks by default). See The sandbox.
High-risk commands are never run by the AI on any server. On the server itself, sudo 3rmonitor ai off, ai read or ai on limits what the agent accepts.
Services
The agent raises an alert by itself for failed services, and for services that are enabled at boot but not running, after several bad reports in a row. On top of that:
- Required services: one per line, for example
myapporqueue-worker. Alert when they are not running. - Ignored services: one per line. No alert when these stop, for example a service you start only by hand.
Regenerate token
Regenerate token, at the bottom of the settings, issues a new token for the server. The old one stops working immediately, so you then have to enroll that server again with the new command (or with sudo 3rmonitor bind).
Server details
Click a server's name (in Servers, on the map or on a server card) to open its details. On the Overview, clicking a server opens a side panel with the essentials; Full details opens the details page.
At the top: the server's status, note, operating system, IPs, last report and agent version, and its availability over 24 hours, 7 and 30 days. Below, four tabs:
| Tab | What it shows |
|---|---|
| Overview | Active alerts; the security summary (vulnerabilities, blocklist status); CPU, memory, disk, load, bandwidth, requests per minute and uptime; traffic usage; resource charts (CPU / memory / disk usage, network traffic, disk I/O, system load, web requests), live or over 1 hour up to 30 days; and the request sources of the last minute and 24 hours |
| System | Host name, operating system, kernel, architecture, virtualization, boot time, uptime, time zone, processes, TCP connections and how the agent runs; CPU (per core) and memory; disks; network interfaces; local certificates (Let's Encrypt) with their expiry dates. A notice appears when a restart is required after system updates. |
| Software and services | The version and status of PHP, Apache, Nginx, MySQL / MariaDB, PostgreSQL, Redis, Docker, Supervisor, Node.js and more (refreshed every 5 minutes); services (running, failed, started at boot, must be running); processes by CPU; listening ports |
| Incidents | The server's incident history; the tab shows how many are ongoing |
The Agent row in System shows how the agent runs, for example "3rmonitor-agent (not root) · AI operations through the root helper · sandbox: systemd 252 · passkeys trusted: 2". It shows a problem in red when the AI can't run anything there (see Troubleshooting), and is empty for agents older than 1.1.0.
Traffic usage
3R Monitor counts how much each server downloads and uploads, from the counters of its network interfaces (the real traffic, not an estimate):
- On the server's details page, Traffic usage shows Today and This month, the quota if one is set (used, limit, percentage and Resets on date), and a bar for each of the last 30 days. Hover a bar, tap it on a phone, or use the arrow keys, to see that day's download, upload and total.
- In the side panel of the Overview: Live, Today and This month, the quota bar and the last 30 days. Details › opens the details page.
- On the server cards of the Overview: Traffic this month, with the quota bar and percentage, or No quota set and today's traffic.
When the quota restarts on a day other than the 1st, "This month" becomes This period, counted from that day. Days follow the panel's time zone. Daily figures are kept for 13 months.
Good to know:
- Counting starts when the master is upgraded to 1.1.1: "Counted since …" shows the first day.
- To count only one interface, the agent must be 1.1.1 or newer. Until it is, all interfaces are counted, and the page says so.
- When the server reboots, its interface counters start again from zero; that is taken into account, and nothing is counted twice. If the master is down for a while, the traffic in between is added to the day it comes back.
- Figures may differ a little from your provider's, which may count other traffic (for example inside its network) or use 1000³ bytes per GB.
- The alerts at 80% and 100% are emailed like other alerts; you can turn them off in Settings → Alert notifications → Send emails about. They clear by themselves when the next period starts or when you raise the quota.
From the command line
On the master:
sudo 3rmonitor server list # registered servers
sudo 3rmonitor server add --name web-2 --group Production # register a server and print its tokenOn a server, to see what its agent collects without sending it:
sudo 3rmonitor agent --print