How to monitor server health over SSH (without installing an agent)
Your website can return a perfect 200 while the server underneath it is dying: disk at 98%, memory swapping, load average climbing. Most monitoring never sees it. The fix doesn't require deploying agents on every box — everything you need is one SSH session away.
Why agentless is underrated
Agent-based monitoring (Prometheus node_exporter, Datadog, Zabbix) is powerful but comes with a tax: install on every server, keep it updated, open extra ports, and re-do it all at every migration or OS rebuild. Agentless SSH monitoring flips the model — the monitoring platform connects to the server, runs standard read-only commands, and closes the session. Nothing to install, nothing to maintain, works identically on Debian, Ubuntu, CentOS and even Windows (via OpenSSH).
The five metrics that catch 90% of incidents
- CPU usage: sustained >85–90% means throttling or a runaway process long before a crash.
- Load average (1/5/15 min): compare against core count — a load of 4.0 is fine on 8 cores, critical on 2.
- Memory: watch used %, but respect cache — a healthy Linux server shows "high" memory that isn't a problem. Alert on swap activity.
- Disk: the most predictable failure in computing. Alert at 85% used, page someone at 95% — the disk that fills at 3am on the 1st of the month.
- Network throughput: RX/TX rates reveal saturated uplinks and DDoS noise that CPU graphs won't explain.
How it works under the hood
On each check the monitor opens an SSH connection, reads /proc and standard tools (top, free, df, /proc/net/dev) and computes deltas for network rates. Typical commands a good agentless collector runs: uptime for load, free -m for memory,df -h for disk, and reads from /proc/net/dev for traffic counters.
Setting sensible alerts
The mistake most people make is alerting on single bad readings. A spike during a backup is not an incident. Alert on: disk >85% sustained, CPU >90% across two consecutive checks, swap usage growing across checks, and load exceeding cores × 2. And set silent hours for the metrics that can wait until morning — disk at 86% is a note, not a siren.
What to combine it with
Server metrics answer "is the box healthy". They don't answer "can a user buy something" — that's what HTTP, keyword and e-commerce flow monitors are for. The strongest setups layer them: uptime checks from multiple locations on the outside, SSH metrics from the inside, SSL expiry so the certificate you renewed in January doesn't die next autumn unannounced.
SiteFlux does all of this natively — including Windows servers over SSH — with alerts via email, Telegram, Slack, SMS and phone calls. See the SSH monitoring feature → or try it free for 7 days.