24observe
checking… Start free
Docs · sensor

The Linux Sensor. One command. Logs and metrics flow.

The 24Observe Sensor is the fastest way to get a Linux server reporting. It wraps Grafana Alloy — installed from Grafana's signed apt repo, never an unsigned binary piped onto your box — and ships journald logs and host metrics to 24Observe over OTLP out of the box.

1. Get your install command

Open the dashboard and go to Settings → Linux Hosts → “Generate install command.” That mints a scoped enrollment token (owner/admin only) and gives you the exact one-liner with the token already filled in. The enrollment token can only enroll hosts — it cannot read your data — and one token can onboard your whole fleet.

The command looks like this:

curl -sSL https://api.24observe.com/install.sh | sudo bash -s -- --enroll-token=<TOKEN>

Run it on the host as root. The Sensor installs Alloy, exchanges the enrollment token for a per-host token that can only ship logs + metrics, writes its config, and starts a systemd service. Re-running it on the same host rotates the host token automatically.

2. Optional: collector profiles

Layer extra log sources on top of the base journald + metrics pipeline with repeatable --profile flags (the dashboard checkboxes add these for you):

curl -sSL https://api.24observe.com/install.sh \
  | sudo bash -s -- --enroll-token=<TOKEN> --profile=docker --profile=nginx

3. Verify

systemctl status alloy        # is the Sensor running?
journalctl -u alloy -f        # follow what it's shipping

Within a minute the host appears under Settings → Linux Hosts → Enrolled hosts, and its logs show up in Explore / Logs. Edge redaction is on by default, so secrets are stripped before anything leaves the box.

Uninstall

curl -sSL https://api.24observe.com/install.sh | sudo bash -s -- --uninstall

Sensor vs. the OpenTelemetry Collector

Use the Sensor when you want a server reporting in one command — it's opinionated (Alloy, journald, host metrics) and self-enrolling. Use the OpenTelemetry Collector when you already run OTel, need OTLP/gRPC in, or have legacy sources (syslog, Fluent Bit). Both land in the same place; pick by how much you want to configure.

Supported today: Ubuntu/Debian + systemd. RHEL and other init systems are on the roadmap.