Web servers & load balancers

Nginx monitoring that reads your logs and stub_status.

The collector finds a running Nginx, auto-discovers stub_status where it is exposed, and reads access and error logs on the host, so 5xx spikes and connection saturation show up as issues without adding a metrics module.

What RootTrace watches

Every reading is checked continuously; bad readings become grouped issues with the evidence attached. RootTrace also remembers whether it has seen the same incident before.

Process presenceA dead or missing Nginx is its own immediate issue.
stub_status metricsActive connections, accepts, and request counters, auto-discovered on common local URLs.
Access log analysisStatus-code mix from the real access log, on the host, with raw request paths redacted before anything is sent.
Error log analysisError-log entries surfaced as evidence, not left for grep.

Warn and fail thresholds, prefilled

Sensible defaults out of the box, overridable per host with environment variables. No threshold spreadsheet required on day one.

Process death and status-endpoint failures drive severity
Status URL override ROOTTRACE_NGINX_STATUS_URL
Log path overrides ROOTTRACE_NGINX_ACCESS_LOG_PATHS

Setup

nginx setup

# zero config on most hosts: the collector auto-discovers stub_status and logs.
# to pin a status endpoint explicitly:
$ export ROOTTRACE_NGINX_STATUS_URL='http://127.0.0.1/nginx_status'

Read-only by architecture: no write path, no remediation executor, no inbound ports. Credential-like evidence is redacted before it leaves the host.

One collector, live in minutes

Everything on this page comes from the same read-only collector: one command per host, then point it at your targets.

install on any Linux host

$ # after adding the signed RootTrace dnf or apt repository:
sudo dnf install roottrace-collector  # apt: sudo apt install roottrace-collector
sudoedit /etc/roottrace/collector.env  # set ROOTTRACE_COLLECTOR_TOKEN and API URL
sudo roottrace-collector-setup apply
sudo systemctl enable --now roottrace-collector

Questions, answered honestly

Do raw URLs from my access logs leave the host?

No. Raw Nginx request paths are on the never-sent list. The collector derives status and latency signals locally and sends the aggregates.

Is this safe to run next to production?

The collector is read-only by architecture, not by policy: there is no write path, no remediation executor, and no privileged mode to switch on. It sends short-lived outbound HTTPS requests, opens no inbound ports, and redacts credential-like evidence before anything leaves the host.

Do I need a separate agent for this?

No. One RootTrace collector per host covers every integration on this site: databases, web servers, containers, endpoints, and the Linux host itself, all from one signed package or container. You point it at targets with environment variables; there is nothing else to deploy.

Free on 5 hosts. Live in minutes.

Create a workspace, install one collector, and watch issues explain themselves.

Create free workspace Schedule a demo