How Opservo works

The score is deterministic (the same facts always give the same number — no hidden AI, no time-of-day noise) and explainable (every point lost traces to a named rule). It’s built in four layers:

1. Collectors gather facts (CPU %, is the firewall on, is a disk 96% full…). Facts only — never opinions.
2. Rules turn a fact into a penalty when it crosses a threshold (e.g. disk >95% → −20).
3. Each category starts at 100 and subtracts its penalties: score = 100 − Σ penalties (floored at 0).
4. The overall score is a fixed-weight blend of the seven categories.

Example. A server with the firewall off (−20) and root SSH login allowed (−30) has a Security category of 100 − 50 = 50. At 20% weight that pulls the overall score down by 10 points — and the dashboard names exactly those two reasons.

Every finding carries a confidence so you can trust it proportionally:

• Definitive — a hard fact (“firewall is disabled”, “disk is 96% full”).
• Likely — a strong but single-sample or derived signal (one CPU reading at 97%).
• Heuristic — a pattern-based guess (“suspicious process”), shown as “worth checking”.

A check shows “n/a” when the agent genuinely can’t measure it on this machine — a probe that needs a physical disk on a cloud VM, or a config file the agent can’t read because it isn’t running as root. Missing data never lowers your score — that category simply scores from the checks it can see, and the panel shows a coverage indicator so it’s honest, not a false “all-good”. Hover any “n/a” to see exactly why.

These are grouped by category. Each check shows what it means for your server; the exact technical source the agent reads lives behind “Technical details” at the bottom of each category — nothing is changed on your server unless you explicitly ask.

Every finding can be resolved without leaving the dashboard, three ways:

• Fix with AI — the AI diagnoses the specific problem and runs the fix, showing you every command first.
• Fix manually — the exact commands are shown to copy/run yourself over SSH (or run in-place if remote actions are on).
• One-click controls — the Security tab has toggles for Firewall, Root login, Brute-force guard (fail2ban) and Auto security updates, plus “Block this IP” for attackers — each with a plain-English confirm dialog.

Running anything requires Remote actions to be turned on for that server (see below). Until then, Opservo is strictly read-only and only shows you the fix.

The agent is a single <10 MB Go binary. It only makes outbound HTTPS calls — there are no inbound ports to open — and every heartbeat is signed (HMAC) so the cloud can’t be spoofed.

• Install — “Add New Server” hands you a one-line command (curl … | sudo … bash). First data appears in under 5 minutes.
• Auto-update — agents check for a new build hourly and update themselves (download → verify checksum → swap → restart). New checks roll out on their own.
• Update from the panel — when a server is behind, an amber “Update agent” button appears in the server header; one click pushes the update (or shows the SSH command if remote actions are off).
• Reinstall — the ⋯ menu → “Re-install / upgrade agent…” gives a command that reuses the server’s credentials (no duplicate server).
• Run as root — a few checks (SSH hardening, sudoers, core dumps, SMART) can only be read as root; otherwise they show “n/a”, never a false pass.

• Read-only by default. The agent never runs a command unless you explicitly enable Remote actions for that specific server — and even then every command is confirmed and written to a permanent audit log.
• Opt-in per server. A fleet-wide agent update never makes a server remotely executable; each box is enabled individually.
• No inbound ports. Commands are pulled over the agent’s existing outbound HTTPS and HMAC-signed — the cloud never connects in.
• Data minimisation. Raw log lines are never stored; IPs/usernames in security findings are masked at the agent before they leave the box.