Free tool

Check a Linux server's health with one command

Paste it into any server. In a few seconds you get 15 checks in plain English — what is OK, what is wrong, and the command that fixes it. No install, no sign-up, nothing sent anywhere.

run on any Linux server — read-only

$ curl -sSL https://api.getopservo.com/check.sh | bash

Want to read it first? curl -sSL https://api.getopservo.com/check.sh | less

In short

The Opservo health check is a free, read-only bash script. Running curl -sSL https://api.getopservo.com/check.sh | bash checks disk and inode usage, memory and swap, CPU load, OOM kills, failed systemd services, database ports open to the internet, local SSL certificate expiry, pending security updates, pending reboots, uptime, clock sync, SSH password and root login, and the firewall — then gives each an OK, WARN or FAIL with the reason and the fix, and a 0–100 score. It works without root and makes no network calls.

What it checks

15 checks, chosen because they take servers down

Check	What it looks at	Thresholds
Disk space	Usage of every real mount (tmpfs, snaps and overlays skipped).	WARN at 85%, FAIL at 95%
Inodes	File-slot usage per mount — the “disk full with free space” trap.	WARN at 85%, FAIL at 95%
Memory	MemAvailable as a share of RAM (not “free”, which counts cache as used).	WARN under 15%, FAIL under 5%
Swap	Swap in use, and whether a small box has none at all.	WARN at 50%, FAIL at 80%
CPU load	5-minute load average against the number of cores.	WARN at 1× cores, FAIL at 2×
OOM kills	Processes the kernel killed for memory since boot, with the last victim named.	WARN on any
Failed services	systemd units in the failed state.	FAIL on any
Database ports	MySQL 3306, PostgreSQL 5432, Redis 6379, MongoDB 27017, Elasticsearch 9200 bound to 0.0.0.0 / [::].	FAIL when open to every interface
SSL certificates	Expiry of certificate files referenced by local nginx and Apache vhosts, read from disk.	WARN under 21 days, FAIL under 7
Security updates	Pending security updates from the local apt / dnf / yum cache.	WARN on any
Reboot required	Updates installed but not yet running (Debian marker, needs-restarting on RHEL).	WARN when pending
Uptime	Days since the last reboot.	WARN over a year
Time sync	Whether NTP reports the clock as synchronised.	WARN when not
SSH	PasswordAuthentication and PermitRootLogin, with Include files resolved the way sshd does.	WARN on passwords, FAIL on root+password
Firewall	ufw or firewalld active (raw iptables/nftables rules too, when run with sudo).	WARN when none found

Sample output

Every finding comes with why and how to fix it

Opservo server health check — web-1 (Ubuntu 24.04.1 LTS) — 2026-10-10 08:07 UTC
Read-only. Nothing is installed, changed or sent anywhere.

Resources
OK    Uptime: 26 days
      why: The server has been up since its last reboot 26 day(s) ago.
OK    CPU load: 0.84 (5-min avg) on 2 core(s)
      why: Load is below the number of cores, so the CPU keeps up with demand.
WARN  Memory: 11% available (431 of 3915 MiB)
      why: Memory is running low; a traffic spike could trigger swapping or the OOM killer.
      fix: Check the largest processes (ps aux --sort=-rss | head) and tune worker counts or add RAM.
FAIL  Disk /: 96% used
      why: Nearly full; writes (logs, uploads, database) will start failing and services can crash.
      fix: Find what is large: du -xh / 2>/dev/null | sort -rh | head -n 20 — clear old logs/backups or grow the volume.
WARN  Out-of-memory kills: 3 since boot
      why: The kernel killed processes to free memory (last: php-fpm8.3); those services crashed or restarted.
      fix: Lower memory use of the killed service, add swap/RAM, and check: dmesg -T | grep -i 'killed process'

Services
OK    Failed services: none
FAIL  Database ports open on all interfaces: Redis:6379
      why: Anyone who can reach this server's IP can try to log in to the database; these are scanned constantly.
      fix: Bind it to 127.0.0.1 (bind-address / listen_addresses / bind) or a private IP, and block the port in the firewall.
OK    SSL certificates: 2 checked, none expiring within 21 days

Maintenance
WARN  Security updates pending: 7
      fix: sudo apt-get update && sudo apt-get upgrade
OK    Clock: synchronized

Security
OK    SSH: password login disabled
OK    SSH: root login = prohibit-password
OK    Firewall: ufw active

──────────────────────────────────────────────────────────────
Score: 55/100 — At risk
10 OK · 3 WARN · 2 FAIL · 0 skipped   (each FAIL −15, each WARN −5)

This was a one-time snapshot. No data left this server.
Want this checked every minute, with AI explaining fixes? Connect this server free: …

Privacy

Read-only, and nothing leaves the server

•No network calls: certificates are read from disk and updates from the local package cache.
•No writes: nothing is installed, configured, restarted or saved.
•No root needed: run it as any user; the output says where sudo would show more.
•No secrets read: it never opens .env files or application config, only system config such as sshd_config and nginx vhosts.

Want this every minute instead of once?

The Opservo agent runs these checks and dozens more continuously, alerts you before the disk fills or the certificate expires, and explains each problem in plain English with the fix — or runs it for you. Free for two servers; installs in 30 seconds.

Connect a server free How the full health score works

FAQ

Questions about the health check

Is it safe to pipe a script from the internet into bash?＋

Only if you trust it, which is why the script is short, readable and changes nothing. Read it first: curl -sSL https://api.getopservo.com/check.sh | less. It only reads files under /proc, /etc and /var and runs read-only commands such as df, ss, systemctl --failed and openssl x509 on local certificate files. It never writes a file, installs a package or opens a network connection.

Does it send my data anywhere?＋

No. The script makes no network calls at all: certificate expiry is read from the certificate files on disk, and pending updates come from the package manager’s local cache. The output is printed to your terminal and nowhere else.

Do I need root?＋

No. Most checks work as a normal user. A few see more with sudo — the kernel log for OOM kills when dmesg is restricted, root-only certificate files, root-only sshd include files and raw iptables/nftables rules — and the output tells you when that applies.

Which Linux distributions does it support?＋

Any Linux with bash and coreutils: Ubuntu, Debian, RHEL, Rocky, AlmaLinux, Amazon Linux, Fedora and others. Checks that need a missing tool (systemd, ss, openssl, apt/dnf) are marked SKIP rather than guessed.

How is the score calculated?＋

It starts at 100 and loses 15 points for each FAIL and 5 for each WARN, never going below zero. 90 and above is Healthy, 70–89 Needs attention, below 70 At risk. It is a quick triage number, not the full Opservo Health Standard, which scores seven categories continuously from the agent.

How is this different from installing Opservo?＋

The script is a one-time snapshot of 15 checks. The Opservo agent reports every 60 seconds, keeps history, alerts you on Slack, email or phone, explains causes in plain English with AI and can run the fix for you — free for two servers.