Glossary
Every term used across these docs, in one place.
Account limit
Section titled “Account limit”A cap WatchTower15 can set on an organisation: how many servers, domains, services, log sources, users or custom metrics it can have, or how many GB of logs it can send in a billing period. Paused resources and suspended users count; delete one to free a slot, or for a server, archive it. At a limit, new additions are refused, new servers are held, and log ingestion stops until the next billing period. Seen under Organisation → Settings → Account Limits. See account limits.
Acknowledge
Section titled “Acknowledge”To mark an open incident as seen and being handled. Needs
incidents.edit, and is recorded on the resource’s Audit tab. An
acknowledged incident is still open — it still auto-resolves when the condition
clears, or can be resolved by hand. See
acknowledge and resolve.
The wt15-server-agent — a single unprivileged binary that runs on a host and
reports telemetry, system information and logs. See the
server agent overview.
An alarm rule applied to one of your resources with your own thresholds — the thing that actually watches something and opens incidents. You author alarms yourself, and a resource can carry more than one alarm from the same rule at different sensitivities. See Alarms & alerting.
Alarm policy
Section titled “Alarm policy”A routing rule that delivers an incident to targets (users, contact groups, or everyone) over one or more channels.
Alarm rule
Section titled “Alarm rule”A template from the built-in catalogue defining one condition — what is measured and what you may tune. Rules are either boolean (pass/fail, escalating on a consecutive-failure streak) or metric (a numeric threshold), and cover servers, domains, services and log sources. See the rule catalogue.
Archived (server)
Section titled “Archived (server)”A server retired from monitoring but kept viewable: it is not monitored or billed, does not count toward the server limit, and moves from the Servers list to its Archived view, while its details, alarms, incidents and Audit tab stay, with its raw charts and logs for 30 days after its last data and its hourly charts for 10 years. A person archives it from its page’s ⋯ menu, teardown automation by instance ID, or WatchTower15 once its agent has not checked in for the days its organisation chooses on Organisation → Settings (Archive servers unseen for the last X days, 2 to 30, 7 by default). Reactivate brings it back once a payment method and a free server slot allow it, and a server archived for silence comes back by itself, within the hour, when its agent reports again. See archived servers.
Audit trail
Section titled “Audit trail”The organisation’s record of what happened and who did it — a
person, or System: WatchTower15 itself or a server’s agent. It covers changes to
resources, enrollment and agent events, alarm configuration, incidents, health
changes, first data received and detected changes, plus sign-ins, users, roles, SSO
and billing. Seen in full on the Audit page with audit.view, and one resource at
a time on its Audit tab. Events are kept indefinitely. See
audit trail.
Audit tab
Section titled “Audit tab”A resource’s own slice of the audit trail: every recorded event about
one server, database, domain, service, log source, custom metric, metric source or server
profile, newest first — the Audit page’s list, locked to that resource. It is the Audit tab
on the resource’s page — the last tab on a server’s, database’s or domain’s page, at the page’s
address followed by /audit — and visible to anyone who can view the resource. Not to be
confused with a domain check’s Change History, which lists what its scans found changed. See
the Audit tab.
Auto-tagging
Section titled “Auto-tagging”See server-led tagging.
Bind scope
Section titled “Bind scope”Where an open port listens: any (every address, 0.0.0.0 or ::),
loopback (the server itself only, 127.0.0.0/8 or ::1), or specific (one or
more particular addresses). It is part of what a port is, so tcp/3306 (any) and
tcp/3306 (loopback) are two different ports. Loopback ports never raise New port
opened. See listening ports.
Change detection
Section titled “Change detection”Comparing a scan result to the previous successful one and flagging what changed (used for DNS, SSL, domain-expiry and WHOIS). Transient outcomes are excluded so blips aren’t treated as changes.
Check / Scan
Section titled “Check / Scan”A single evaluation of a resource — agent telemetry, a check of a service by its collectors, or an outside-in probe of a domain such as DNS, SSL or reachability. Records a status and an outcome. See monitoring.
Collector
Section titled “Collector”One of your servers, running the server agent, that checks a database or a service for you. You choose a resource’s collectors as a pool (servers or a tag); WatchTower15 picks which of them run the checks. See Services.
Contact group
Section titled “Contact group”A named set of people that an alarm policy can target as a unit.
Courtesy account
Section titled “Courtesy account”An organisation whose usage WatchTower15 covers — for a trial or a partnership, for example. It needs no payment method, and its invoices are courtesy invoices. A courtesy period can have an end date, after which usage is billed. See courtesy accounts.
Courtesy invoice
Section titled “Courtesy invoice”An invoice marked Courtesy voided: it covers usage of a courtesy account, lists the full value of that usage for your records, and has an amount due of zero. It is never charged and sends no email. See courtesy accounts.
Disk usage report
Section titled “Disk usage report”A picture of what is filling one of a server’s volumes: its largest folders and files by name, size and date, never their contents, and nothing inside a user’s home folder. The agent takes one about once a day per monitored volume, and when a volume is first seen or a volume alarm opens. See disk usage reports.
Domain
Section titled “Domain”A resource representing a public domain, watched outside-in for DNS, certificate, expiry and reachability. A subdomain or a wildcard is not checked for registration or WHOIS, so its page has no Registration or Whois tab. See the domain page.
Enrollment
Section titled “Enrollment”The one-time process where an agent registers a host into your organisation using an organisation token, receiving its identity and secret.
Ephemeral port
Section titled “Ephemeral port”A port inside the host’s ephemeral range (net.ipv4.ip_local_port_range; Linux’s default
is 32768–60999), which the kernel hands out for outgoing connections and to programs that
ask for any free port. An open port in that range is recorded while it is
open and forgotten 24 hours after it closes. It is never charted and never alarmed on.
Health
Section titled “Health”A resource’s overall state — Healthy, Warning or Critical — reflecting its highest open incident severity. A server’s health also counts the open incidents on its volumes, listening ports and system services. Any resource is Unknown until a value is first measured (a log source or metric source until its first data arrives), and becomes Healthy then if nothing is firing. Heat maps show Unknown as No data, and an unreachable server in slate, whatever its health. Every change is recorded in the resource’s Audit tab.
Held server
Section titled “Held server”A server whose agent enrolled after the organisation’s server limit was reached, or while it had no payment method (or an overdue invoice). It waits in Pending, tagged Waiting — server limit reached or Waiting — payment required: not monitored, not billed, and not counted toward the limit, until the slot or the payment method is there and someone approves it from its page’s ⋯ menu. See held servers and without a payment method.
Incident
Section titled “Incident”An open problem for a resource, opened by an alarm rule,
carrying a severity of warning or critical. Auto-resolves when
the condition clears.
The filesystem record behind every file, directory and symlink. On ext2/3/4 the number of inodes is fixed when the filesystem is created. A filesystem that runs out of them cannot create files — “No space left on device” — even with free disk space. The agent reports inode usage per filesystem. See inodes.
journald source
Section titled “journald source”Logs shipped by the agent from the systemd journal, on the
stream journald.
Log source
Section titled “Log source”Anything that sends log lines without running the agent — a Lambda, a CI job, a container. Authenticated by a per-source bearer token and billed per GB, like agent logs. See log sources.
Source
Section titled “Source”Whatever sent a log line: an enrolled server or a log source. The Sources filter in log search selects across both.
Stream (log stream)
Section titled “Stream (log stream)”A label on each log line identifying what within its source produced
it — by default a file’s basename, or journald, or a label the sender chose. A
first-class field you can filter on in log search.
Previously labelled “Log source” in the interface; that name now means the entity above.
Notification channel
Section titled “Notification channel”The medium an alarm policy delivers through: email, Slack,
Microsoft Teams, or a generic webhook.
Open port
Section titled “Open port”A port a process on a server is listening on: a TCP port waiting for connections, or a UDP port bound with no fixed peer. The agent reports them with every system-information snapshot, each with its bind scope and the owning process’s name, never its command line. WatchTower15 remembers every port a server has had, ephemeral ports apart, so at any moment a port reads open, closed, or no data when no complete report covered that time. See listening ports and the port alarms.
Organisation
Section titled “Organisation”The top-level tenant. Every resource, tag, log line and audit record is scoped to one organisation; access within it is governed by roles & permissions. You can create one by registering, which makes you its Admin; one account can belong to several organisations.
Outcome
Section titled “Outcome”The finding of a check: data_found, no_data,
target_not_found, blocked, or lookup_unavailable. blocked and
lookup_unavailable are excluded from alarms and change detection.
Permission
Section titled “Permission”A granular module.tier grant (e.g. domains.edit, logs.view). Bundled into
roles. See the permission catalogue.
Passkey
Section titled “Passkey”A WebAuthn credential (Touch ID, Windows Hello, a security key, or a synced passkey from a password manager) that signs a user in without a password. Personal to the user rather than to an organisation, and unavailable to users whose organisation enforces SSO. See passkeys.
Profile (server agent profile)
Section titled “Profile (server agent profile)”A named bundle of agent configuration — collection intervals, log files, and tagging rules — shared by many hosts and updated centrally. See fleet & profiles.
Resource
Section titled “Resource”Anything monitored and metered: a server, a domain, or a service.
A named set of permissions, scoped to an organisation. Built-ins are Admin and Regular Users; custom roles are supported and a user may hold several.
Server
Section titled “Server”A resource representing a host, watched inside-out by the agent.
Server-led tagging
Section titled “Server-led tagging”The agent reading identity metadata from AWS, Docker (WT15_TAG_<Name> variables only) and Kubernetes at
enrollment and reporting it as tags. WatchTower15 then
applies the profile’s advanced-tagging filter server-side,
on enrollment and every heartbeat, to decide which are kept. Also called
auto-tagging. See tagging.
Service
Section titled “Service”A resource representing an endpoint (HTTP/HTTPS/TCP/UDP), checked for reachability and response by your own servers, its collectors, from inside your network. Added under Services and billed as a resource. Not to be confused with a system service, a systemd unit running on one of your servers.
Service parameter
Section titled “Service parameter”A named value a service’s check reads on its collectors — from AWS
Parameter Store, AWS Secrets Manager, a file on the collector or a URL, in one of six
formats — and inserts as {{param.name}} into the path, headers, body or authentication.
WatchTower15 stores where to read it, never the value. See
Services.
Severity
Section titled “Severity”The urgency of an incident: warning or critical. Metric rules
compare to thresholds; boolean rules escalate on consecutive failures.
Single sign-on with Google or Microsoft, with DNS-verified domains and per-organisation enforcement. See SSO.
Status
Section titled “Status”The execution health of a check: queued, running,
completed, failed, timeout — distinct from its outcome.
System service
Section titled “System service”A systemd service unit on a server — what systemctl status nginx shows, such
as nginx.service or sshd.service. The agent reports every one on the host with
each system-information snapshot, and watches the ones expected to run: whether each is up,
how often systemd restarts it, and how much memory it uses. Part of the server, not a
resource of its own, and not a Service (an external endpoint checked from
outside). See system services and the
system service alarms.
A value inside a tag group, applied to resources to organise, filter and target them.
Tag group
Section titled “Tag group”The key or category a tag belongs to. System groups (Organisation-wide, Server, Domain, Service, Log-Source, Custom-Metric and Database) scope which resource types a tag can apply to; Custom-Metric covers metric sources too. See tagging.
Telemetry
Section titled “Telemetry”The high-frequency host vitals the agent reports every 15 seconds (CPU, memory, disk, network, load). See metrics & telemetry.
Unreachable
Section titled “Unreachable”A server’s connectivity state once WatchTower15 has had no heartbeat from its agent for 5 minutes or more — the moment Agent stopped reporting warns. Shown on the server’s page with a banner, in the Servers list’s Last Seen column and Connectivity filter, in slate on heat maps, in the Silent agents and Agent activity widgets, and counted in a notice at the top of every page. A server powered off cleanly reads Powered off instead, and one whose agent WatchTower15 is refusing for its clock Rejected; the notice, heat maps and widgets count a rejected server with the unreachable ones once 5 minutes pass without an accepted heartbeat.
Verified domain
Section titled “Verified domain”A domain an organisation has proven it controls via a DNS TXT record, used to anchor SSO enforcement.
Volume
Section titled “Volume”A filesystem mounted on a server, such as / or /data, as its agent
reports it. Every volume that holds real storage is watched on its own: whether it is full,
filling up, running out of inodes or has turned read-only. See
server volumes and the volume alarms.
Least privilege
Section titled “Least privilege”The principle that the agent runs with only the privileges its job needs: an unprivileged service user, never root, and exactly two read capabilities. See the privilege model.