The Linux Sensor. One command. Logs and metrics flow.

The 24Observe Sensor is the fastest way to get a Linux server reporting. It installs from a signed package — never an unsigned binary piped onto your box — and ships journald logs and host metrics to 24Observe over OTLP out of the box. It's built on open standards under the hood, so nothing about it is proprietary or locked in.

1. Get your install command

Open the dashboard and go to Settings → Linux Hosts → “Generate install command.” That mints a scoped enrollment token (owner/admin only) and gives you the exact one-liner with the token already filled in. The enrollment token can only enroll hosts — it cannot read your data — and one token can onboard your whole fleet.

The command looks like this:

curl -sSL https://api.24observe.com/install.sh | sudo bash -s -- --enroll-token=<TOKEN>

Run it on the host as root. The Sensor installs itself, exchanges the enrollment token for a per-host token that can only ship logs + metrics, writes its config, and starts a systemd service. Re-running it on the same host rotates the host token automatically.

2. Optional: collector profiles

Layer extra log sources on top of the base journald + metrics pipeline with repeatable --profile flags (the dashboard checkboxes add these for you):

curl -sSL https://api.24observe.com/install.sh \
  | sudo bash -s -- --enroll-token=<TOKEN> --profile=docker --profile=nginx

• --profile=docker — Docker container stdout/stderr logs.
• --profile=nginx — nginx access + error logs.

3. Verify

sudo 24observe-sensor status   # is the Sensor running?
sudo 24observe-sensor logs -f  # follow what it's shipping

Within a minute the host appears under Settings → Linux Hosts → Enrolled hosts, and its logs show up in Explore / Logs. Edge redaction is on by default, so secrets are stripped before anything leaves the box.

Uninstall

curl -sSL https://api.24observe.com/install.sh | sudo bash -s -- --uninstall

Sensor vs. the OpenTelemetry Collector

Use the Sensor when you want a server reporting in one command — it's opinionated (journald, host metrics, sensible defaults) and self-enrolling. Use the OpenTelemetry Collector when you already run OTel, need OTLP/gRPC in, or have legacy sources (syslog, Fluent Bit). Both land in the same place; pick by how much you want to configure.

Supported today: Ubuntu/Debian + systemd. RHEL and other init systems are on the roadmap.