Watch Owl overview
The agent you install on your own servers. What it collects, how it enrols, and why it is the only thing in StatusOwl that currently sends you an alert.
Watch Owl is StatusOwl's system monitoring agent — a small, statically linked Go binary that runs as a service on your own machines and reports back to your dashboard.
Monitors watch a service from the outside. Watch Owl watches the host from the inside.
A failing HTTP, ping or TCP check does not send you anything. A Watch Owl alert rule does — to email, Slack, Discord, Teams, ntfy or a webhook. If you want StatusOwl to actively tell you something is wrong and you own the host, this is the route that works end to end today. See Notifications overview.
What it collects
- CPU — utilisation, including per-core, load average and steal time.
- Memory — used, available, cached, and swap.
- Disk — capacity and free space per mounted filesystem. Pseudo filesystems
(
overlay,tmpfs,devtmpfs) are skipped. - Network — throughput per interface. Loopback excluded.
- Host metadata — hostname, OS, kernel, architecture, uptime.
- Patch state — pending updates, security updates, and whether the OS is flagging a reboot as required.
Patch and reboot state is the one people underuse. A fleet where nothing is
down but half the hosts have been asking for a reboot for six weeks is a
different kind of problem, and pending_updates plus reboot_required surface
it without anyone running a script.
Supported platforms
Linux, Windows and macOS. Patch and reboot detection is implemented natively per platform rather than shelled out to a single package manager.
The Linux install guide covers the APT and DNF repositories. Windows and macOS builds are distributed as signed packages; the enrolment flow is the same on all three.
How enrolment works
- Create an install token in the dashboard. Tokens are scoped to your organization and can be one-time or reusable with a max-uses count.
- During install, the agent exchanges the install token for a long-lived host credential. The credential is written to disk with restrictive permissions and never leaves the machine.
- From then on the agent authenticates every report with that credential. Each host gets a stable identifier in the dashboard.
Running the enrol flow again on the same machine creates a fresh host record and a fresh credential. The previous host shows as inactive until you remove it. This is deliberate — it stops server rebuilds and baked container images from silently overwriting each other's history.
Plan limits
Every plan includes one Watch Owl host. The limit is flat across Free, Starter, Growth and Scale. The dashboard shows the current count when you go to enrol.
Alert rules
Once metrics are flowing, define threshold rules against them — CPU over 90% for ten minutes, disk over 85% on a named mount, a host that has not reported for five minutes. Rules evaluate server-side every 60 seconds, fire and resolve on their own, and route to whichever integrations you pick.
Containers
Watch Owl reports the host. To see individual Docker containers — which are running, their CPU and memory, how often they have restarted — run Dockman alongside it. Watch Owl tells you the machine is fine; Dockman tells you which container on it is not.