Host Detail Page

Overview

The Host Detail page is the single-host workbench in PatchMon. Reach it by clicking any host's friendly name from the Hosts page, or navigate directly to /hosts/<hostId>. Every action, statistic, and tab for a specific host lives here: connection status, package counts, repositories, integrations, patch runs, agent queue, credentials, and (when the relevant modules are enabled) Docker inventory and compliance results.

This page is a guided tour of the layout: what to click and what each tab is for.

Permission required: can_view_hosts to open the page. Mutating actions (trigger report, change groups, toggle integrations, delete host, run patches) need can_manage_hosts.

Page Header

The top of the page has four main areas:

Identity strip

• Friendly name (large heading), editable inline.
• Hostname and IP underneath, both editable inline (clicking shows a text field; Enter to save, Esc to cancel).
• Status pills (four independent indicators, each with a hover tooltip explaining what it means):
  • WS — WebSocket control channel state. Green when connected, amber while disconnected within the configured grace window, red once the grace window elapses. The grace window is the host_down alert threshold (default 30 seconds, see Per-alert-type configuration).
  • Reporting — agent report freshness. Grey ("Awaiting report") until the agent sends its very first report, then green when the agent has reported within its update interval, amber when overdue but the WebSocket is still connected (agent is alive, just hasn't pushed yet), red ("Stale") when overdue and the WebSocket is also disconnected.
  • Reboot pending — only shown when the host has flagged a pending reboot (e.g. /var/run/reboot-required, kernel updates).
  • Updates — grey "No package data" until the first report arrives, then green "Up to date", amber "Updates pending" (non-security only), red "Security patches required" when one or more security updates are available.
• Uptime and Last updated relative timestamps.

If there's a pending patch run awaiting a fresh post-patch report, you'll see an Awaiting inventory report chip that links to the run.

Action buttons (top right)

Package statistics cards

Four clickable cards:

• Total Installed → opens Packages filtered by this host.
• Outdated Packages → Packages filtered to this host with only those needing updates.
• Security Updates → Packages filtered to this host with only security updates.
• Repos → opens Repositories filtered to this host.

Use these as quick jump-offs, with the host pre-selected. The Packages page you land on stays scoped to that host: its heading names the host, its own summary cards count only that host, and a Clear filter button widens it back out to the whole fleet.

The Tab Strip

Below the cards is a horizontal tab bar. On desktop, all content is inside tabs; on mobile, sections are stacked as cards and tabs are replaced by quick-jump links.

The tab strip is context-aware. Some tabs only appear under certain conditions:

Each tab below is described as what you see and what you can do.

Host Info

Quick reference panel for the host's identity and agent settings. Fields include:

• Friendly Name: inline-editable.
• IP Address: inline-editable; if the agent has picked a primary interface, this field is read-only and tagged from eth0 (or whatever the interface is).
• Hostname: inline-editable.
• Machine ID: read-only unique hardware identifier.
• Host Groups: coloured multi-select chips. Add or remove groups; changes save on blur.
• Operating System: icon plus OS type and version (detected by the agent).
• Agent Version: version of patchmon-agent currently reporting.
• Agent Auto-update: per-host toggle. If global auto-update is disabled, a yellow warning badge is shown with a tooltip pointing to Settings → Agent Updates.
• Force Agent Version Upgrade: the Update Now button sends an immediate upgrade command via WebSocket. Disabled when the agent is offline.

See Managing the PatchMon Agent for what the agent does when it receives an upgrade command.

Network

Visible when the agent has reported network data. Two sections:

• DNS Servers: grid of resolvers the host uses.
• Network Interfaces: one card per NIC with:
  • Name, type, and UP/DOWN status.
  • MAC address, MTU, and link speed / duplex.
  • All inet and inet6 addresses with netmask and gateway.
  • A star icon to mark one interface as the primary. PatchMon will use that interface's primary address as the host's IP everywhere in the UI, overriding auto-detection.

Clearing the primary flag re-enables auto-detection.

System

Hardware and OS specifics collected on each report:

• Kernel version, SELinux status, architecture, package manager.
• CPU model, socket/core counts, frequency.
• Memory: total, used, free, swap (formatted in GiB).
• Storage / disk layout.
• Hardware vendor, product, serial number (where the agent can read it).
• SSG (OpenSCAP) version when the compliance integration is enabled.

This tab is read-only. All values come from the agent report.

Agent Activity

Unified timeline of every agent comm cycle for this host. Each row is one of:

• Ping: hash-gated check-in (every cycle, even when nothing changed).
• Full / Partial: /hosts/update with the full inventory or just the sections the server flagged as stale.
• Docker / Compliance: integration-specific submissions.
• Job: outbound queue jobs the server sent to the agent (fetch report, patch run, integration setup, etc.).

The four queue stat cards (Waiting / Active / Delayed / Failed) sit above the table and reflect in-flight server-to-agent jobs. The auto-refresh interval is 30 seconds.

Each report row also shows section chips: green "Updated" chips for sections the agent shipped fresh data for this cycle, and muted "Skipped" chips for sections the server already had a matching hash for. Use this tab to:

• Confirm a host is actively checking in (look for recent Ping rows).
• Audit when a package, repo, network interface, or hostname change last propagated.
• Trace a "my Fetch Report click didn't do anything" complaint by following the job row through Waiting → Active → Completed (or Failed with the error message).

Retention is governed by the AGENT_REPORTS_RETENTION_DAYS environment variable (default 30 days, range 7..365). The daily cleanup sweep at 02:00 deletes anything older. See the operator guide for tuning details.

Earlier releases split this view across two tabs (Package Reports and Agent Queue). Bookmarks against the old ?tab=history and ?tab=queue query params redirect to ?tab=activity.

Notes

A free-text area for operator notes: change windows, ownership, special configuration, support contacts. Click into the text area to edit, then Save.

Notes are visible to any user with can_view_hosts on this PatchMon deployment.

Integrations

Per-host toggles and setup status for optional agent integrations. Two primary panels:

Docker

• Toggle: enables Docker discovery for this host. When off, no containers / images / volumes / networks are collected.
• The change is staged as a pending configuration; a yellow banner appears at the top of the tab until the change is applied.
• Click Apply in the page header to push the change to the agent via WebSocket. The agent updates its config.yml and reports back.

See Enabling Docker Integration for prerequisites and troubleshooting.

Compliance Scanning

• A three-state selector: Disabled, On-Demand, Enabled.
  • Disabled: no scans.
  • On-Demand: only run when triggered from the UI; not included in scheduled reports.
  • Enabled: scans run on the agent's normal reporting interval.
• Setup status indicator showing Installing / Ready / Partial / Error, with per-component status (OpenSCAP, Docker Bench).
• Scanner Types section: individual toggles for OpenSCAP (CIS Benchmarks) and Docker Bench (the Docker Bench toggle is disabled if the Docker integration is off on this host).

Changes require the agent to be connected via WebSocket.

Refresh Status

The Refresh Status button at the top right of the tab asks the agent to report its current integration readiness immediately. Useful after installing OpenSCAP manually on the host.

Reporting

Host-scoped overrides for alerting. The tab is hidden when global alerts are disabled in Settings.

Primary feature: Host Agent Down Alerts with three states:

• Inherit from global settings (default).
• Enabled: always create alerts when this host's agent goes down, regardless of global defaults.
• Disabled: never create alerts for this host even if the global setting is on.

Use the Disabled override for hosts that are expected to be intermittent (dev laptops, ephemeral CI runners) so they don't spam your alert channels.

Docker (conditional)

Appears only when the host has actually reported a working Docker integration on at least one report. The tab is a compact per-host version of the fleet-wide Docker Inventory Tour.

Sub-tabs: Stacks, Containers, Images, Volumes, Networks. Each sub-tab shows counts in a badge next to its name.

Requires the docker module to be enabled on your plan. Plans without the module show a tier badge on the tab and an upgrade prompt inside.

Patching

Per-host patch run history and trigger point. Shows:

• A filterable, sortable, paginated list of runs for this host.
• Status chips (queued, running, completed, failed, approval pending).
• Inline output for completed runs.
• The Patch all button at the top of the Host Detail page is the quick way to start a new run scoped to this host.

Requires the patching module. The tab displays a tier badge when unavailable.

Compliance (conditional)

Appears when the compliance integration has been set up and at least one scan has run. Shows the latest benchmark results, failed rules with remediation guidance, and history. The agent installs OpenSCAP automatically when the integration is enabled; this tab surfaces that install's progress plus scan output.

Requires the compliance module.

Terminal

Browser-based SSH session to the host, proxied through the agent. No inbound port is needed on the host; the connection is routed over the existing agent WebSocket. Typical workflow:

1. Open the Terminal tab.
2. PatchMon fetches a short-lived SSH ticket and opens a WebSocket to the agent.
3. The agent connects to localhost SSH (or the configured target) and relays the session.
4. AI-assisted analysis is available within the terminal UI.

Gated by the ssh_terminal module. The agent-side ssh-proxy-enabled switch in config.yml must also be on. This is not a UI toggle, due to its security implications. See the SSH section of Agent Configuration Reference.

RDP (Windows only)

Browser-based RDP session using a Guacamole (guacd) gateway on the PatchMon server. Like the Terminal tab, it uses the agent to reach the host without requiring inbound firewall rules.

Visible only on Windows hosts, gated by the rdp module, and requires the agent-side rdp-proxy-enabled switch to be on in config.yml.

Credentials Modal (Deploy Agent)

Click Deploy Agent (key icon) in the page header to open the modal. Two tabs:

Quick Install

A copy-ready install command for this host, pre-populated with its API ID and API key. Options:

• Force install (bypass broken packages): Linux / FreeBSD only.
• Self-signed certificate (SSL bypass): Windows only.
• Use curl instead of Invoke-WebRequest: Windows only, workaround for hosts where PowerShell's downloader is blocked.

Click Copy. You're automatically moved to the Waiting for Connection screen, which polls until the agent connects and sends its first report. This is identical to step 4 of the Add Host wizard.

API Credentials

• API ID: copyable.
• API Key: obscured by default. The plaintext key is only available if it was just created or regenerated; otherwise the field shows hashed – not usable.
• Regenerate: creates a new API ID and key and invalidates the old ones. Use this if credentials have been lost or compromised. The agent on the host will need to be reconfigured or the install command re-run.

Common Actions: Where to Click

Quick reference for the most-asked "how do I…" questions:

Mobile Layout

On smaller screens, the tab strip is replaced with stacked cards (Host Information, Network, System, Agent Activity, and so on). The action buttons collapse into an icon row. Some dense sections (for example the Integrations mode selector) show a Manage in Integrations tab shortcut.

All data shown on mobile is the same as on desktop; only the layout changes.

Related Pages

• Adding a Host: how a host gets here in the first place.
• Managing Host Groups: editing group membership.
• Managing the PatchMon Agent: CLI equivalents of the actions on this page.
• Enabling Docker Integration: what turning on the Docker toggle actually does.
• Docker Inventory Tour: the fleet-wide view of the data surfaced on the Docker tab.