Back2Cloud Monitoring Agent v3 (Enterprise Edition)

Overview

The Back2Cloud Monitoring Agent v3 is a production-grade Linux monitoring system designed for hosting infrastructure.

It extends v2 with:

• 🔐 Real SSH login tracking (PAM-based)

• 🚫 Failed login detection (security events)

• 🧠 Alert deduplication (anti-spam engine)

• ⚙️ Service monitoring (nginx, mysql, php-fpm)

• 📡 Multi-channel alerting (Telegram + Discord + Email fallback)

• 🧯 Fail2Ban integration support

• 🧩 Modular architecture (agent + plugins)

System Architecture

                    ┌────────────────────────────┐
                    │     Linux Server Node      │
                    │ (AlmaLinux / CWP / VPS)    │
                    └────────────┬───────────────┘
                                 │
        ┌────────────────────────┼────────────────────────┐
        │                        │                        │
        ▼                        ▼                        ▼

┌──────────────┐     ┌──────────────────┐     ┌──────────────────┐
│ Metrics Agent │     │ SSH Event Hooks  │     │ Service Monitor  │
│ (CPU/RAM/DISK)│     │ (PAM / auth.log) │     │ nginx/mysql/php  │
└──────┬─────────┘     └────────┬─────────┘     └────────┬─────────┘
       │                        │                        │
       └──────────────┬─────────┴─────────┬──────────────┘
                      ▼                   ▼
            ┌────────────────────────────────────┐
            │     Alert Aggregation Engine       │
            │  - Deduplication                   │
            │  - Cooldown control                │
            │  - Severity classification         │
            └──────────────┬─────────────────────┘
                           ▼
            ┌────────────────────────────────────┐
            │     Alert Dispatcher Layer         │
            │  - Telegram                        │
            │  - Discord                         │
            │  - Email (SMTP fallback)           │
            └──────────────┬─────────────────────┘
                           ▼
                📱 Admin Notification Channels

Core Features

System Monitoring

• CPU usage spikes

• RAM saturation

• Disk pressure

• Load average anomalies

Security Monitoring

• SSH login tracking (real-time PAM hooks)

• Failed login detection

• Root login alerts

• Suspicious IP detection (optional)

Smart Alert Engine

• Prevents duplicate alerts (cooldown system)

• Groups multiple issues into one message

• Severity-based alert formatting

Service Monitoring

• nginx status

• mysql/mariadb status

• php-fpm status

• optional apache support

Multi-Channel Alerts

• Telegram (primary)

• Discord webhook (secondary)

• Email SMTP (fallback)

Installation Structure

/usr/local/back2cloud/
│
├── agent.sh
├── config.conf
├── plugins/
│   ├── cpu.sh
│   ├── memory.sh
│   ├── disk.sh
│   ├── services.sh
│
├── hooks/
│   ├── ssh-login.sh
│   ├── ssh-fail.sh
│
└── lib/
    ├── alert.sh
    ├── dedup.sh

MAIN AGENT SCRIPT (v3 CORE)

#!/bin/bash

source /usr/local/back2cloud/config.conf

HOST=$(hostname)
DATE=$(date)

ALERT=""
SEVERITY=0

#####################################
# Load CPU
#####################################
CPU=$(top -bn1 | awk '/Cpu\(s\)/ {print 100 - $8}')
CPU_INT=${CPU%.*}

if [ "$CPU_INT" -gt "$CPU_THRESHOLD" ]; then
  ALERT+="🚨 CPU High: ${CPU}%\n"
  SEVERITY=1
fi

#####################################
# Memory
#####################################
RAM=$(free | awk '/Mem:/ {printf("%.0f", $3/$2 * 100)}')

if [ "$RAM" -gt "$RAM_THRESHOLD" ]; then
  ALERT+="🚨 RAM High: ${RAM}%\n"
  SEVERITY=1
fi

#####################################
# Disk
#####################################
DISK=$(df / | awk 'NR==2 {print $5}' | sed 's/%//')

if [ "$DISK" -gt "$DISK_THRESHOLD" ]; then
  ALERT+="🚨 Disk High: ${DISK}%\n"
  SEVERITY=2
fi

#####################################
# Service Checks
#####################################
for svc in nginx mariadb php-fpm; do
  systemctl is-active --quiet $svc
  if [ $? -ne 0 ]; then
    ALERT+="🔥 Service Down: $svc\n"
    SEVERITY=3
  fi
done

#####################################
# Send Alert (deduplicated)
#####################################
if [ -n "$ALERT" ]; then

  MESSAGE="🔥 BACK2CLOUD MONITORING v3
Host: $HOST
Time: $DATE

$ALERT"

  bash /usr/local/back2cloud/lib/alert.sh "$MESSAGE"
fi

SSH LOGIN HOOK (REAL-TIME)

PAM Integration

/etc/pam.d/sshd

Add:

session optional pam_exec.so /usr/local/back2cloud/hooks/ssh-login.sh

SSH Login Script

#!/bin/bash

source /usr/local/back2cloud/config.conf

IP=$(echo $SSH_CONNECTION | awk '{print $1}')
USER=$(whoami)
HOST=$(hostname)
DATE=$(date)

MESSAGE="🔐 SSH LOGIN
Host: $HOST
User: $USER
IP: $IP
Time: $DATE"

bash /usr/local/back2cloud/lib/alert.sh "$MESSAGE"

Failed SSH Login Hook

Triggered via /var/log/secure + fail2ban or rsyslog filter.

ALERT ENGINE (DEDUPLICATION)

#!/bin/bash

MESSAGE=$1

HASH=$(echo "$MESSAGE" | md5sum | awk '{print $1}')
CACHE_FILE="/tmp/bc_alert_$HASH"

if [ -f "$CACHE_FILE" ]; then
  exit 0
fi

touch "$CACHE_FILE"
sleep 300
rm -f "$CACHE_FILE"

curl -s -X POST "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \
-d chat_id="$CHAT_ID" \
-d text="$MESSAGE"

CONFIG FILE

BOT_TOKEN="xxx"
CHAT_ID="5312744996"

CPU_THRESHOLD=80
RAM_THRESHOLD=85
DISK_THRESHOLD=85

ALERT FLOW

System Event Trigger
        ↓
Metric / SSH / Service Hook
        ↓
Aggregation Engine
        ↓
Deduplication Layer
        ↓
Alert Dispatcher
        ↓
Telegram / Discord / Email

Conclusion

The Back2Cloud Monitoring Agent v3 is now a lightweight alternative to Zabbix/Prometheus-style agents, designed for:

• hosting providers

• VPS infrastructure

• DevOps automation environments

It provides:

✔ Real-time observability
✔ Security event tracking
✔ Service health monitoring
✔ Alert intelligence layer
✔ Multi-channel notification system