Monitoring¶

Monitoring watches a machine after the software is on it. An agent on the device reports the state of that device on a cycle. Midair compares each report with the accepted baseline, and it lists the differences.

The agent is Delta. It collects the signals of the host: the processes, the open ports, the mounts, the file fingerprints, the installed packages, and the network interfaces.

The Monitoring section of the sidebar has two screens:

Devices: The monitored devices.
Distributions: The agent builds. See Distributions.

Add a device¶

The device wizard asks four questions:

The name, the address, the SSH port and the login.
The operating system and the CPU architecture. Midair needs both, because the agent is built for the machine that it runs on. A wrong architecture produces an agent that the device cannot execute.
The monitoring feature set.
The workspaces that the device belongs to.

The name, the address, the login and the platform are required. The feature set has defaults.

A device that belongs to no workspace reports drift that no workspace shows.

Monitoring feature set¶

The feature set says what the agent collects:

Open ports: The open network ports and the services behind them.
Memory management: The memory use and the process statistics.
CPU load: The CPU load and the utilisation.
Access management: The access events and the permissions.

The agent¶

Midair builds the agent for the platform of the device, deploys it over SSH, and starts it. The device row carries the actions:

Start, Stop: Deploy and start the agent, or stop it.
Enable, Disable: Tell a running agent to report or to stay quiet. A disabled agent still sends a heartbeat.
Collect: Ask a running agent for a report now.

The agent sends each report to the address that the Delta integration names. That address must be reachable from the device. See Integrations.

Device states¶

building: Midair is building the agent for this platform.
starting, stopping: Midair is deploying and starting the agent, or stopping it.
stopped: The agent is not running.
failed: The last operation failed. The record holds the error.
disabled: The agent runs, and it reports nothing but a heartbeat.

The row then shows one of three derived labels:

Baseline: The agent is collecting the first report, which becomes the baseline.
Active: The agent reports, and the last report matches the baseline.
Active drift: The agent reports, and the last report differs from the baseline.

The device screen¶

The device screen has two tabs.

Overview shows the counters of the last cycle: the deviations, the anomalies and the changes. Under them are the status, the cycle number, the time of the last report, the device type, the build target, the agent token and the report interval.

Two columns hold the difference from the baseline:

Appeared: What the report holds and the baseline does not.
Missing: What the baseline holds and the report does not.

Activity shows the history: the time between the reports, the anomalies for each cycle, and the changes for each cycle.

Baseline¶

The baseline is the accepted state of the device. Every difference from it is drift.

Accept as baseline takes the differences that the device currently shows and adds them to the baseline. Accept one entry, or accept all of them at once. Watch this again removes an entry from the baseline, so the device reports it again.

Reachability¶

A report can carry a STUN block. It says whether the device reached the STUN server, the public address that the server saw, and the round-trip time. Use it when the device sits behind a NAT and you need to know how it appears from outside.