Install
Sign in, open Add server, and copy the command shown there. It carries a one-time enrolment token, so it is specific to your account:
curl -sSL https://fleetwatch.io/install.sh | sh -s -- <your-token>
Run it as root on any Linux server. It will:
- install a single static binary at
/usr/local/bin/fleetwatch-agent(about 4.6 MB, no dependencies) - register the server and save its own credentials to
/etc/fleetwatch/agent.json - install and start a systemd service
Registration happens before the service is installed, so a bad token fails immediately rather than leaving a service that restarts forever. The server appears on your fleet page about two seconds later. amd64 and arm64 are supported; hosts without systemd are told how to start the agent themselves.
What it collects
- CPU usage, from
/proc/stat - Memory used and total, from
/proc/meminfo - Disk used and total for
/ - 1-minute load average and uptime
- The number of running Docker containers, if a Docker socket is present
That is the whole list. It does not read your files, your environment variables, your logs, or the contents of your containers. A sample goes out every 30 seconds.
Two numbers are deliberately not what some tools report. Memory used is total minus available, not total minus free — Linux uses spare memory as cache, and counting that as "used" makes a healthy machine look full. Disk counts root-reserved blocks as used, because an ordinary process cannot write into them.
Security
The agent connects outward. We never connect to you. There is no inbound port to open and no firewall rule to add, and we do not ask for an SSH key — so a breach on our side does not become root on your fleet.
Each server gets its own credential at enrolment. The token in the install command is separate and revocable, so one pasted into a chat log or a CI job can be retired without every agent you already installed going dark.
Tokens are stored only as hashes; we cannot show you one again after it is issued. Your organisation's data is isolated in the database itself, not only by the application — a query that forgot its filter returns nothing rather than someone else's fleet.
The systemd unit runs with NoNewPrivileges, ProtectSystem=strict and ProtectHome, and can write only to its own state directory.
Uninstall
systemctl disable --now fleetwatch-agent rm -rf /usr/local/bin/fleetwatch-agent /etc/fleetwatch /etc/systemd/system/fleetwatch-agent.service systemctl daemon-reload
Then remove the server from your fleet page. It stops counting toward your plan from that moment.
Troubleshooting
The server never appeared. Check systemctl status fleetwatch-agent and journalctl -u fleetwatch-agent. The most common cause is outbound HTTPS being blocked.
It says "token was rejected". The server was removed from your fleet page, so its credential no longer exists. Run the install command again to register it afresh.
It went offline but the machine is up. A server is marked offline after two minutes without a sample. Usually the agent stopped or outbound traffic is being dropped; the service restarts itself, so check the journal for what it hit.