Monitoring your VPS: resources, alerts and availability

A server that goes down at 3 a.m., a full disk that blocks the database, a process hogging the CPU for a week: without monitoring, you hear about it from your users. This guide sets up three levels of monitoring, from the simplest to the most complete, suited to a VPS.

1. What to monitor

2. Live diagnostics

When something slows down, these commands answer within seconds:

uptime                          # load average over 1, 5 and 15 minutes
free -h                         # memory and swap
df -h                           # disk space per partition
du -xh / --max-depth=2 2>/dev/null | sort -rh | head -15   # heaviest folders
journalctl -k | grep -i "out of memory"                     # processes killed for lack of memory

For an interactive overview, install btop: CPU per core, memory, disk, network and processes on a single screen.

apt install -y btop && btop

3. Keep a history with sysstat

The previous commands show the present moment. To find out what happened last night during the outage, you need a history. sysstat records the main indicators every ten minutes, at negligible cost:

apt install -y sysstat
sed -i 's/ENABLED="false"/ENABLED="true"/' /etc/default/sysstat
systemctl enable --now sysstat

Then view today's history, or a previous day's:

sar -u          # CPU
sar -r          # memory
sar -n DEV      # network traffic per interface
sar -u -f /var/log/sysstat/sa17   # history for the 17th of the month

4. Get an alert on Discord

A script of a few lines is enough to be warned before disaster strikes. In Discord, create a webhook: Channel settings → Integrations → Webhooks, and copy its URL. Then create /usr/local/bin/vps-alert.sh:

#!/bin/bash
WEBHOOK="https://discord.com/api/webhooks/YOUR_WEBHOOK"
HOST=$(hostname)
alert() {
  curl -s -H "Content-Type: application/json" \
    -d "{\"content\": \"⚠️ $HOST: $1\"}" "$WEBHOOK" >/dev/null
}
DISK=$(df --output=pcent / | tail -1 | tr -dc '0-9')
[ "$DISK" -ge 85 ] && alert "disk at ${DISK} %"
MEM=$(free | awk '/Mem:/ {printf "%d", $7/$2*100}')
[ "$MEM" -le 10 ] && alert "available memory at ${MEM} %"
for svc in nginx mariadb; do
  systemctl is-active --quiet "$svc" || alert "service $svc is stopped"
done

chmod +x /usr/local/bin/vps-alert.sh
echo '*/10 * * * * root /usr/local/bin/vps-alert.sh' > /etc/cron.d/vps-alert

Adapt the list of services to your server: fivem, minecraft, docker… The script stays silent when everything is fine.

5. Monitor availability from outside

A script on the server cannot warn you if the server itself is unreachable. Availability must be monitored from another machine. Uptime Kuma is the reference open-source tool: it checks your websites over HTTP, your game servers by ping or TCP port, certificate expiry, and sends alerts to Discord, Telegram or by email.

Install it on a second small VPS with Docker, following the complete example in Docker and Docker Compose. It can also publish a public status page for your community.

6. A complete dashboard with Netdata

To go further, Netdata collects hundreds of metrics per second and displays them in detailed charts, with no configuration. It does use some CPU and memory, though: on a 2 GB VPS, prefer sysstat. Installation is done with the official script published on Netdata's website.

Once installed, the dashboard listens on port 19999. Do not expose it publicly: it reveals a lot of information about your server. Access it through an SSH tunnel or through WireGuard:

ssh -N -L 19999:127.0.0.1:19999 alex@VPS_IP
# then open http://127.0.0.1:19999 in your browser

7. Reading the signals

• Swap in constant use: the VPS is short of memory. Reduce consumption, such as the memory allocated to Java or the database cache, or move to a bigger plan.
• High load but low CPU usage: processes are waiting for the disk. Find the culprit with iotop.
• Disk filling up steadily: it is almost always logs or local backups. Check /var/log, Docker logs and journalctl --disk-usage.
• Abnormal network traffic: an attack may be under way. See limiting the impact of a DDoS attack.

To receive a summary of the server's events every morning, see also daily reports with Logwatch.

Frequently asked questions