Objective
Spot the degradation or failure of a component early and keep a record of security events, with few but meaningful alerts.
Architecture
Pulse monitors the state of the Proxmox cluster in real time: nodes, VMs, containers, and storage. Wazuh collects logs and flags security events, OpenVAS runs periodic vulnerability scans, and OpenCanary acts as a honeypot to detect unauthorized access attempts. Periodic checks on updates, backups, and logins complete the picture.
Details
What is monitored
- state of nodes, VMs, and containers, with CPU, memory, and disk usage (Pulse);
- health of the storage pools, SMART status of the disks, and UPS status;
- outcome of backup jobs;
- security events and centralized logs (Wazuh);
- known vulnerabilities on exposed systems (OpenVAS) and unauthorized access attempts (OpenCanary).
Alerting principles
Few alerts, but always useful: each one says what is wrong, has a severity, and points to a verification procedure. Alerts that lead to no action are removed or toned down. Thresholds start from conservative values and are reviewed after the first results.
Current state
- Pulse is active and monitors the cluster in real time.
- Wazuh, OpenVAS, and OpenCanary are installed but stay off most of the time: they are switched on in rotation for the periodic checks, consistent with the security baseline described in SSH hardening on Debian: a practical checklist.
- Notification channel: email for routine alerts, a dedicated Telegram bot for critical ones (so I notice them even when I am away from a computer).