Platform features

Everything your infrastructure needs — packaged for teams without a dedicated ops function

Eight capability areas, each designed for least privilege, without vendor lock-in, and without a bill that surprises you at month-end.

Server agent

Deploy in 30 seconds. A non-root service.

A single curl command, run once as root, installs the wt15-server-agent as its own non-root service user with two Linux capabilities, used only for reading, and nothing else.

  • NoNewPrivileges=yes — no setuid binary can raise the privileges of the agent or anything it starts
  • ProtectSystem=strict — the entire filesystem is read-only except the agent's state directory and log file
  • Two capabilities, CAP_SYS_PTRACE and CAP_DAC_READ_SEARCH, used only for reading, such as per-process metrics, log files and disk usage reports
  • Credential file isolated to the agent's own state directory
  • Upgrades itself in place, as its own service user — no manual intervention
  • Self-contained log at /var/log/wt15-server-agent.log
# Install — one command, run once as root
$ curl -fsSL https://api.watchtower15.com/api/agent/install-script \
| sudo sh -s -- <org_token>

==> Installing on prod-01 (amd64) ...
==> Creating unprivileged user: wt15-server-agent
==> Enrolled successfully (agent_id=wt15-a8f3c2e1)
==> ✓ Monitoring active

# Systemd unit — two capabilities, nothing else
[Service]
User=wt15-server-agent
NoNewPrivileges=yes
ProtectSystem=strict
AmbientCapabilities=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
CapabilityBoundingSet=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
Domain monitoring

Know before your users do — across every DNS record type

External probes run every 60 seconds against your domains, SSL certificates and reachability endpoints — from UK/EU infrastructure, so your latency data is relevant to your users. Your services are checked by your own servers, from inside your network.

  • DNS: A, AAAA, MX, CNAME, TXT, NS, SOA record monitoring
  • SSL/TLS certificate health — expiry, chain validity, cipher strength
  • Domain registrar expiry tracking — alert before renewals lapse
  • HTTP/TCP/UDP service checks run by your own servers, with response-time tracking
  • Configurable scan intervals — from every 60 seconds to daily
  • Historical scan data retained for trend analysis
example.com AHealthy
example.com MXHealthy
example.com SSLValid · 87 days
example.com ExpiryExpires in 14 days
api.example.com HTTP200 · 142 ms
shop.example.com TCP:443Reachable
Last scan32 seconds ago
Security scanning

Security posture without a SIEM

SSL/TLS analysis, DNS anomaly detection and domain expiry monitoring are built directly into the platform — no additional licence, no separate toolchain. No other SMB uptime tool offers this breadth.

  • SSL certificate chain validation — catches intermediate cert issues before browsers do
  • TLS protocol version & cipher analysis — flag deprecated TLS 1.0/1.1 usage
  • DNS anomaly detection — alert on unexpected record changes that may indicate hijacking
  • Domain expiry alerts — configurable thresholds (90, 30, 7 days)
What UptimeRobot monitors

SSL certificate expiry date only — nothing else in this list.

TLS protocolTLS 1.3 ✓
Certificate chainValid (3 certs) ✓
Cipher suiteStrong ✓
DNS A recordNo changes detected
DNS MX recordChanged 2h ago
Domain expiry⚠ 14 days — renew now
Security posture2 items need attention
Alerting & governance

SSO, audit logs and alarm policies — included at base

Governance features that competing products gate behind enterprise plans come standard with WatchTower15. Your team can enforce access control and maintain a full audit trail from day one.

  • Single sign-on with Google and Microsoft, on your DNS-verified domains
  • Role-based access control (RBAC) — Admin and Regular Users roles, plus your own custom roles, per organisation
  • Full audit log — every action timestamped and attributed to a user
  • Alarm policies with configurable thresholds and escalation rules
  • Alert channels: email, Slack, PagerDuty, webhook — no extra cost
  • Organisation-level resource isolation — multi-org access for agencies and MSPs
SSO providerMicrosoft ✓
Active users12 members
Audit log entries3,847 this month
Active alarm policies7 policies
Alert channelsSlack · PagerDuty · Email
Enterprise plan requiredNo — included at base
Log ingestion

Centralised log search — no separate log platform required

The server agent pushes structured log batches directly to the platform — and anything else you run can push to the same ingest API with a per-source token. Logs are stored in VictoriaLogs and S3 simultaneously, giving you fast full-text search alongside durable archival.

  • Agent pushes NDJSON log batches — no syslog forwarding to configure
  • Dual-write: VictoriaLogs for fast search, S3/MinIO for archival
  • Full-text search across all enrolled servers in one interface
  • Log folder patterns configurable per server agent profile — push to all servers simultaneously
  • Log level faceting — filter by ERROR, WARN, INFO across your entire fleet
  • journald support alongside file-based streams
  • Custom log sources — push from Lambda, CI, containers or any HTTP client with a bearer token
  • One search across agent-shipped and API-pushed logs
Log ingest (last 24h)2.4M lines
ERROR events47 events
WARN events312 events
Storage backendVictoriaLogs + S3
Search latency< 200 ms
Separate log platformNot required
Fleet management

Push config changes to every server in your fleet simultaneously

Server agent profiles let you define telemetry options, log collection rules once — then push them to all enrolled servers at once, without SSH access.

  • Server agent profiles — define config templates in the dashboard
  • Assign profiles to individual servers or groups with tags
  • Config changes are pushed on next agent heartbeat — no SSH required
  • Telemetry options: CPU, memory, swap, disk, disk I/O, network, load, processes
  • Log folder rules with regex patterns and file extension filters
Profile: production-servers8 servers
Telemetryevery 15 s (set by WatchTower15)
Active metricsCPU · Memory · Disk · Network
Log folders/var/log/nginx · /var/log/app
Config versionv12 — all agents current
Last config push3 minutes ago ✓
Database monitoring

MySQL and MariaDB monitoring — and we never connect in

Your own servers collect your databases from inside your network and push what they find out to WatchTower15. No inbound rule, no public endpoint, no VPN — and read-only credentials that never leave your estate.

  • Amazon RDS for MySQL, Aurora MySQL, RDS for MariaDB, and MySQL or MariaDB you run on EC2
  • Egress-only: the agent connects out to the database and out to WatchTower15
  • Credentials from Secrets Manager, SSM Parameter Store, RDS IAM or a file — we store only where they are
  • A read-only monitoring user, created by a generated grant script
  • Collector pools with automatic failover between your servers
  • Sixteen default alarms: unreachable, restarts, connections, replication, slow queries, deadlocks, error-log errors, storage filling up, schema changes, RDS storage, CPU and burst balance
  • Thirty days of data coverage, with every gap explained by its cause
Database: orders-prodActive
Collected byapp-01 · standby app-02
Connections42% of max
Replication lag0 s
Data coverage, 30 days99.9%
Inbound rules for WatchTower15None needed
API

Your monitoring, from your own code

A versioned REST API for your scripts, CI jobs and integrations: read your servers, domains, services, incidents, logs, custom metrics and databases, acknowledge and resolve incidents and run domain scans, with a key you control.

  • A REST API at /v1, with an OpenAPI 3.1 reference
  • Acknowledge and resolve incidents, or scan a domain now, from a script
  • Keys limited to the areas you choose, and expiring by default
  • A key never sees more than its owner's role
  • Each organisation decides who may create keys
  • Rate limits and errors that scripts can read
  • Included with every account: no add-on, no tier
From your scriptsScoped keys
List servers with open incidentsGET /v1/incidents
Pull the last hour's error logs into CIGET /v1/logs
Check certificates before a releaseGET /v1/domains
Acknowledge the incident your pager openedPOST /v1/incidents/…
Get started

Ready to deploy least-privilege monitoring?

Talk to us about your infrastructure — we'll show you how WatchTower15 fits into your stack and give you a concrete picture of what your bill will look like.

Get startedContact Sales