DEV Community

Bartosz Osiej
Bartosz Osiej

Posted on Originally published at bo.hartwell-labs.pl

Fleet Monitoring for Linux: Managing 100+ Servers Without Kubernetes

#linux #ebpf #fleet #monitoring

The misconception

"Fleet monitoring = Kubernetes monitoring." It is not. Kubernetes is a
scheduling/orchestration control plane that some fleets happen to use. Most
Linux fleets — edge, bare metal, on-prem, air gaps, mixed distros — are just
hosts that need watching. You should not have to stand up a cluster to watch
them.

The right mental model: an agent per host (one static binary), a shared
event sink, and one dashboard keyed to a per-host identity that survives
re-imaging. Everything else is implementation detail.

Why agents that are "just a CLI" fail at fleet scale

Tools that work on one host and fall apart at 100 nodes:

  • They write state to /tmp keyed by hostname → PID/host confusion when hosts are rebuilt.
  • They assume a single machine-id, so a fleet dashboard can't tell host A from host B after a re-image.
  • They have no fleet identity, so correlation is "grep the logs by hostname" (slow, lossy) instead of "join on machine-id."

Talus's fleet model is deliberately the anti-silo: every event carries the
host's machine-id (and a per-machine license seat), and the agents all speak
the same wire format to a shared sink.

The fleet stack (one binary, no cluster) 

host A        host B        host N
  |             |             |
talus          talus         talus
(1 static      (same          (same
 binary)       binary)        binary)
  |             |             |
  +------+------+------+-----+/
         |               |
    Kafka / ClickHouse   MemGraph (process tree)
         |
   dashboard + SIEM
Enter fullscreen mode Exit fullscreen mode
  • Agent: one ELF (x86_64 + aarch64), eBPF tracepoints, signed audit log.
  • Sink: Kafka topics, ClickHouse, or MemGraph — pick one, all ships.
  • Licensing: per-machine annual keys, machine-id-pinned, server-side seat enforcement. Fleet tier is $30/node/year from 3 nodes.

Deploy that survives chaos

At 100+ hosts the deployment story is what bites first. Talus's pattern that
works on mixed fleets:

  1. One package. pip install talus-process-monitor on every distro, or the static binary from GitHub Releases — no package-manager wars.
  2. Root once, run without it. eBPF load needs root/CAP_BPF at attach; after that the drain and scorer drop privileges via seccomp + Landlock. That is why Talus self-sandboxes — it matters more on a fleet than on one box.
  3. Identity via machine-id. Each agent registers with /etc/machine-id + a per-node license. Re-imaging a node? talus license deactivate on the old, activate on the new — seats stay honest, no double-billing. 
# fleet deploy example (any CM, here shaped as Ansible)
- hosts: all
  tasks:
    - name: install talus
      ansible.builtin.command: talus install
    - name: activate license
      ansible.builtin.command: talus license activate {{ talus_license_key }}
Enter fullscreen mode Exit fullscreen mode

Fleet threat detection you can actually read

The killer use-case is not "one host" but cross-host timing:

  • 10:03:17 hostA opens 41k files — kill.
  • 10:03:18 hostB opens 18k files — kill (lateral from A in <1 s).
  • 10:03:19 hostC — blocked before it started, because the sink saw B's canary and pre-empted.

That timing is invisible to per-host-only tools and invisible to SIEMs fed by
polled logs. Kernel-attached agents feeding a shared sink are the only way to
see sub-second lateral moves.

Managing seats and cost

  • Fleet license: $30 / node / year, min 3 nodes, max 500, cancel any time.
  • A node that goes dark stops billing only when you deactivate it — there is no "phantom usage" trap.
  • Batch prepaid keys exist if procurement needs PO + net-30; contact@hartwell-labs.pl.

class="buy-button">Fleet pricing ($30/node) →

{"@context":"https://schema.org","@type":"Article",
"headline":"Fleet Monitoring for Linux: Managing 100+ Servers Without Kubernetes",
"description":"eBPF agent-per-host fleet monitoring without Kubernetes: per-machine licensing, shared Kafka sink, cross-host correlation.",
"author":{"@type":"Person","name":"Bartosz Osiej"},
"datePublished":"2026-10-20","dateModified":"2026-10-20",
"mainEntityOfPage":{"@type":"WebPage","@id":"https://bo.hartwell-labs.pl/content/fleet-monitoring-linux"}}

Top comments (0)