CT-Ops
Host Infrastructure
How to use CT-Ops host infrastructure tabs for storage, network, patching, services, and logs.
The Infrastructure area explains how the host is built and connected. Use it when you need to understand disks, interfaces, network membership, patch posture, service state, or host-side logs.
The Infrastructure parent tab contains six child tabs: Storage, Network, Networks, Patch Status, Services, and Host Logs. The parent tab opens on Storage by default. The Storage and Network child tabs show count badges when the agent has reported disks or interfaces.
Storage tab
The Storage tab lists disk information reported by the agent. It shows the storage devices and usage data available from the host heartbeat metadata.
Use this tab after the Overview page reports disk pressure, before increasing capacity, or when checking whether an incident is isolated to one mount point. It is also useful after agent rollout because it confirms the agent can collect disk metadata for the host.
Storage table
| Column | Meaning |
|---|---|
| Mount Point | Filesystem mount point reported by the host, such as /, /var, or /data. This is the row key in the UI. |
| Device | Backing device name reported by the host, for example a block device, logical volume, or mapped device. |
| Filesystem | Filesystem type reported by the host. Use it to separate local disks from special filesystems and mounted volumes. |
| Total | Total capacity of the filesystem. CT-Ops formats the raw byte value into bytes, KB, MB, GB, or TB. |
| Used | Used capacity on the filesystem, formatted from bytes. |
| Free | Free capacity on the filesystem, formatted from bytes. |
| Used % | Percentage used, shown with one decimal place. Values above 70% are amber; values above 90% are red. |
| Full in | Stored forecast based on daily disk snapshots. Calculate now refreshes it immediately. Estimates beyond two years, including non-growing mounts with enough history, show Greater than 2 years. Legacy root history uses the historic aggregate disk percentage; other current mounts can be seeded with a stable baseline from their latest reported usage until per-mount history accumulates. |
If the agent has not reported disks yet, CT-Ops shows No disk data yet and waits for the next heartbeat. If a disk is missing from the table, first check that the host can collect disk telemetry and that the agent heartbeat is fresh.
Storage behavior
The Storage tab is read-only. It does not run a live disk query when opened; it renders the latest disk metadata stored from agent heartbeats. Use the Monitoring tab for time-series disk trends and the Tools area for operational tasks. Use Storage when you need the current filesystem inventory and a quick answer to which mount is under pressure.
Network tab
The Network tab lists host network interfaces, MAC addresses, IP addresses, and interface status from heartbeat metadata. Use it to confirm which addresses the agent sees locally.
Use this tab when troubleshooting ingest connectivity, network membership, duplicate host identity, DNS mismatches, a host that appears in the wrong subnet, or a service bound to an unexpected interface.
Network interfaces table
| Column | Meaning |
|---|---|
| Interface | Interface name, such as eth0, ens18, or lo. |
| MAC Address | Hardware address when the host reports one. CT-Ops shows a dash when the value is empty. |
| IP Addresses | One or more IP addresses assigned to the interface. CT-Ops shows each address on its own line and shows a dash when none were reported. |
| Status | Up when is_up is true, otherwise Down. The badge is green for up interfaces and grey for down interfaces. |
If no interfaces have been reported, CT-Ops shows No network data yet until the next heartbeat includes interface information.
Network behavior
The Network tab is read-only. It does not edit interface state and it does not force a live network scan. The values come from the latest host metadata. If the tab disagrees with a live shell, wait for the next heartbeat or check whether collection is disabled or failing on the agent.
Networks tab
The Networks tab shows the CT-Ops networks this host belongs to. Each membership shows the network name, CIDR, and whether assignment is Auto or Manual.
Automatic membership means the host heartbeat reported an IP address inside a defined network CIDR. Manual membership means an operator added the host directly. You can add the host to another network or remove existing memberships from this tab.
Use this tab to understand blast radius. Network membership is used by reports, filters, vulnerability spread analysis, and subnet planning. It is also useful when an auto-assigned host needs to be associated with a business or operational network that cannot be inferred from IP address alone.
Networks list
| Field or control | What it does |
|---|---|
| Network name | Opens the network detail page for that network. |
| CIDR | Shows the network range, such as 10.10.0.0/24. Use it to check whether automatic membership is expected. |
| Auto | Membership was inferred because a host IP matched the network CIDR. |
| Manual | Membership was added by an operator. |
| Trash button | Removes the host from the network membership. The button is disabled while a removal is in progress. |
If the host is not in any networks, CT-Ops shows Not in any networks and explains that automatic assignment will happen when a host IP matches a defined CIDR. The empty state includes an Add to Network button for manual assignment.
Add to Network dialog
| Control or field | What it does |
|---|---|
| Add to Network | Opens a dialog listing networks the host is not already in. The top button is disabled when the host already belongs to every available network. |
| Network name | Identifies an available network that can be manually assigned. |
| CIDR | Shows the network range before you add the host. |
| Add | Creates a manual membership for the selected network. The button shows a loading spinner while the request is in progress. |
| Already-in-all-networks message | Appears when there are no remaining networks to add. |
| Close | Closes the add dialog without changing membership. |
Networks permissions and validation
Adding or removing host network membership requires a role allowed to manage
network membership. CT-Ops rejects duplicate manual membership with Host is
already in this network and rejects removal when the membership no longer
exists. Manual membership is stored with autoAssigned: false; automatic
membership is managed by CT-Ops based on host IP addresses and defined network
CIDRs.
Patch Status tab
The Patch Status tab shows whether the host is within patch-age policy. It includes current patch status, days since last patch, maximum allowed patch age, outstanding update count, average patch interval, and detailed patch metadata.
Use this tab before running patch tasks, during compliance reviews, or when an alert says a host is outside patch policy. If update listing is unsupported for the host package manager, rely on patch age, patch history, and task output rather than the outstanding-update count.
Patch telemetry states
If CT-Ops is still loading data, the tab shows Loading patch status…. If the host has not reported patch telemetry yet, the tab shows Patch status pending with a Refresh button. A queued refresh is collected on the next agent heartbeat; it is not an immediate SSH-style command.
The Refresh button queues a bounded patch telemetry refresh task for the agent and then refreshes the tab data. While the request is pending, the button is disabled and shows a spinner. If the backend rejects the request, CT-Ops shows the error below the button.
Patch summary cards
| Field | Meaning |
|---|---|
| Patch Status | Shows Within policy for pass, Outside policy for fail, Check error for error, and Unknown for anything else. |
| Days Since Last Patch | Shows the number of days since the last detected patch event. If no date was reported, it shows Unknown and says no last-patched date was reported. If the host exceeds policy, it shows how many days overdue it is. |
| Policy | Shows the maximum allowed patch age in days. This is the threshold used to decide whether the host is within policy. |
| Files With Updates | Shows the number of available updates reported by the agent. If update listing is not supported, the card says Listing not supported. |
| Average Patch Interval | Shows the average number of days between detected patch events. If there is not enough history, it says Not enough history yet. |
Patch Details panel
| Field | Meaning |
|---|---|
| Last patched | Date and exact timestamp of the last detected patch event. Shows Unknown when the host did not report one. |
| Last checked | Exact time CT-Ops last checked or received patch status for this host. |
| Package manager | Package manager detected by the agent, when available. |
| Update listing | Shows the update count when listing is supported, otherwise Not supported. |
| Patch history points | Number of detected patch dates used for history calculations. |
| Longest patch gap | Longest interval between detected patch dates. |
| Error message | Amber warning message shown when patch collection returned an error. |
| Warnings | Additional collection warnings from the patch telemetry payload. |
Current outstanding patch work table
The Current outstanding patch work card lists package or file updates when the agent supports update listing. If listing is unsupported, CT-Ops says package update listing is not supported for the operating system. If listing is supported but no updates are found, CT-Ops says no current package updates were reported.
| Column | Meaning |
|---|---|
| File | Package or update name reported by the agent. |
| Current | Installed version, or a dash if not reported. |
| Available | Available version, or a dash if not reported. |
| Architecture | Package architecture, or a dash if not reported. |
| Repository | Source repository, or a dash if not reported. |
Use this table to decide which package work is outstanding before scheduling patch activity. It is not a package manager UI; it reports what the agent found.
Patch interval history chart
The Patch interval history card shows how regular patching has been on this host.
| Field or chart | Meaning |
|---|---|
| Average interval | Average days between detected patch dates. |
| Longest gap | Largest days-between-patches value in the history. |
| Shortest gap | Smallest days-between-patches value in the history. |
| Interval bars | One horizontal bar per patch-to-patch interval. The label shows the starting and ending patch dates, and the value shows the number of days between them. Bars are scaled relative to the longest interval on the host. |
| Empty history message | Appears when fewer than two distinct patch dates exist. At least two dates are required to calculate days between patch events. |
| Detected patch dates | Badge list of patch dates detected in telemetry. |
Services tab
The Services tab lists service inventory and service state. Operators can search services, review active or failed state, and see resource data such as CPU and memory where available.
The tab starts a list_services agent query when opened and refreshes the query
every 30 seconds while the tab is mounted. CT-Ops polls a pending query every
second until it completes or errors.
Use this tab when an application is down, a service restart is suspected, or you need to turn a discovered service into a monitored process check and alert.
Services controls
| Control | What it does |
|---|---|
| Filter services | Filters the table by service name, load state, active state, or sub-state. |
| Refresh | Starts a new list_services query against the agent. The button is disabled and shows a spinner while the query is running. |
| Row monitor menu | Opens the monitoring controls for that service. |
| Check switch | Adds or removes a process check for the service. |
| Alert switch | Adds or removes an alert rule for the service. If the service does not already have a process check, adding an alert creates one first. |
| Green shield icon | Indicates an enabled process check already exists for the service process name. |
| Amber bell icon | Indicates an enabled alert rule already exists for the service check. |
Services table
| Column | Meaning |
|---|---|
| Service | Service name reported by the agent. CT-Ops uses this as the default process or systemd unit name for service monitoring. |
| Load | Service load state reported by the host, or - when missing. |
| Active | Active state reported by the host, or - when missing. |
| CPU | CPU percentage reported by the agent. Values below 0.05% display as 0%; missing values display as -. |
| Memory | Current memory usage reported by the agent. Values are formatted in B, KiB, MiB, GiB, or TiB; missing or non-positive values display as -. |
| Status | Green badge when active state is active or sub-state is running; red Failed badge when active state or sub-state is failed; otherwise a grey badge with the sub-state, active state, or Unknown. |
| Monitor | Shows monitoring icons and opens the row menu for check and alert switches. |
If the query fails, CT-Ops shows the returned error. While the first query is running, it shows Querying services from the agent…. If the agent returns no services, it shows No services were returned by the host.
Add service check dialog
The Check switch opens Add service check when no enabled process check matches the service process name.
| Field or control | Meaning |
|---|---|
| Name | Required check name. Defaults to <process> service. Backend validation requires 1 to 100 characters. |
| Process name | Required process or systemd unit name for the process check. Defaults to the full service name, such as docker.service. |
| Interval | Check interval value and unit. Defaults to 1 minute. Backend validation allows 10 seconds through 24 hours. |
| Unit selector | Supports Seconds, Minutes, and Hours. The numeric input bounds change with the selected unit: seconds 10-86400, minutes 1-1440, hours 1-24. |
| Cancel | Closes the dialog without creating a check. |
| Add check | Creates the process check. The button is disabled while saving, or when name or process name is blank. |
Turning the Check switch off opens a confirmation dialog. Removing a service check stops the check from running, removes its history from the service row, and also removes any active service alert linked to that check.
Add service alert dialog
The Alert switch opens Add service alert when no enabled alert rule is linked to the service check.
| Field or control | Meaning |
|---|---|
| Name | Required alert rule name. Defaults to <process> service down. Backend validation requires 1 to 100 characters. |
| Process name | Shown only when CT-Ops must create a process check first. Required. Defaults to the full service name, such as docker.service. |
| Check interval | Shown only when CT-Ops must create a process check first. Defaults to 1 minute and follows the same 10-second to 24-hour bounds as service checks. |
| Consecutive failures before firing | Required failure threshold for the check-status alert. Defaults to 3. Backend validation allows 1 through 10. |
| Severity | Alert severity. Defaults to Warning and supports Info, Warning, and Critical. |
| Cancel | Closes the dialog without creating an alert. |
| Add alert | Creates the alert rule, and creates the process check first if needed. The button is disabled while saving, when the alert name is blank, or when a required process name is blank. |
Turning the Alert switch off opens a confirmation dialog. Removing the alert stops alert firing for the service check but leaves the process check in place.
Host Logs tab
The Host Logs tab uses agent queries to list and read approved log files.
It supports search, match filtering, and following a log as new data arrives.
Use it when you need immediate host-side evidence without opening a separate SSH
session. The viewer starts a list_logs agent query when the tab mounts.
| Control or field | What it does |
|---|---|
| Refresh | Starts a new list_logs query against the agent. The button shows a spinner while the list query is running. |
| Filter log files | Appears before a file is selected. Filters the discovered file list by path. |
| Log file list | Shows discovered log paths with size and modified time. Select a file to read it. |
| Resizable divider | Lets you widen or narrow the file list on large screens. The list defaults to 320 px, cannot go below 240 px, cannot go above 760 px, and preserves at least 360 px for the viewer. |
| Selected path title | Shows the selected log path, or Select a log file before selection. |
| Loaded progress | Shows how much content has been loaded, for example Loaded to 64.0 KB of 2.0 MB. |
| Search loaded log | Highlights matching text in loaded content. Matching is case-insensitive. |
| Filter | Shows only loaded lines that contain the search text. If no lines match, the viewer says No matching log lines. |
| Follow | Reads appended log content every 2 seconds while enabled. |
| Analyse with AI | Appears only when at least one AI model is enabled in CT-Ops. Opens a selection dialog for the loaded log lines. |
| Reload | Reads from offset 0 with the initial read limit and replaces the current viewer content. The button is disabled while a read is running. |
| Viewer | Shows the selected log content in a monospace panel. Before selection it says Choose a log file to view its latest content. |
The Analyse with AI dialog does not send the whole loaded log. Select the specific entries you want CT-Ops to analyse, then choose Send to AI. You can select one line, hold Shift, and select another line to include the range between them. If multiple AI models are enabled, choose the model in the dialog before sending.
AI analysis explains the selected error messages, suggests diagnostic commands, suggests fix commands, and includes validation checks. The result remains in the dialog with a follow-up question box so you can paste command output or ask for clarification without sending unrelated log lines.
CT-Ops initially reads the last 64 KB of a selected file. While following, it
reads appended chunks of up to 32 KB every 2 seconds. Backend validation caps a
read_log request to a path of 1 to 1024 characters, a non-negative offset, and
a limit from 1 byte to 64 KB.
Use Follow for active incidents and turn it off when reviewing old evidence so the viewer does not keep moving. Selecting a new file clears the previous content, disables follow, and reads the tail of the new file.