Every monitoring tool falls into one of two camps:
Agent-based (Datadog, Netdata, New Relic): install a daemon on every server. It collects everything, streams it out.
Agentless (UptimeRobot, Better Stack, and the tool I built): probe from outside. For deep system metrics, SSH in on demand.
The docs will tell you about latency and resource overhead. The real tradeoffs are elsewhere.
What agent-based gets you
- Rich host metrics without giving anyone SSH access
- Works behind NAT/firewalls (agent dials out)
- Continuous collection, not 5-minute snapshots
What nobody mentions about agents
- It's another thing you maintain. A daemon that dies silently = monitoring that lies to you. Who monitors the agent?
- It's an attack surface with root, phoning home. You vetted the vendor once; you run their binary forever, with every privilege.
- On a $6 VPS, it eats your RAM. Some agents want 100-300MB. That's real money at indie scale.
What agentless gets you
- Zero footprint: nothing installed, nothing to update, nothing to break
- The trust conversation is explicit: the vendor needs SSH, so you can constrain it — dedicated user, sudo whitelist, audit trail
- Cheap probes are fine for the 80% case: is it up, is the disk full, is the cert expiring
What agentless costs you
- SSH access is the crown jewel — if the vendor leaks it, you're exposed (encrypt keys at rest, scope the user)
- No per-process continuous metrics; you see snapshots, not streams
- Firewall rules must allow inbound probes (or you need a callback model)
My rule of thumb
- Running a fleet of 50+ production servers with real SLOs → agent-based, full observability
- Running 1-10 VPS as an indie dev → agentless probes + (if the vendor supports it) whitelisted SSH for auto-repair
The agents-vs-no-agents debate is really a question: do you want a rich stranger living in your house, or a neighbor with a key who only comes in when something's wrong?
For most solo developers, it's the neighbor. How are you handling it?
Top comments (0)