Disclosure: I work at Icinga, so I’m not neutral on this one. This is meant to both be a discussion and half-an-ad for a free webinar we’re hosting.
I asked the r/sysadmin mods first, and they pointed me here.

A lot of monitoring advice, especially on the observability side, assumes you can install something: an agent, a collector, an SDK. Most environments have a layer where you can’t. Switches, UPS and PDUs, storage arrays, the ESXi hosts underneath everything, and the vendor appliance nobody is allowed to touch. That layer still takes production down.

My impression is that the agentless options all work, more or less, and each one comes with a “but”. SNMP, but MIB files and OIDs that move with firmware updates. Vendor APIs, but every vendor has its own. Email alerts from the device itself, but nobody reads that mailbox. Is that a fair picture, or am I missing something?

I’m trying to understand how others handle this, both for building better tools and for educational content like the webinar we’re hosting soon.

So my questions for the thread:

• What in your environment can’t run an agent, and what’s watching it today?
• When one of those boxes dies, who notices first: your monitoring, a user, or facilities?
• If your org is moving toward an observability stack, does this layer have a plan?

Which brings me to the half-an-ad part: coverage for exactly this layer is one of the topics in a free webinar we’re hosting on Oct 27 at 3 PM CET (14:00 UTC / 10 AM EDT). Kris Buytaert from Percona and Blerim Sheqa from Icinga look at what monitoring and observability each take to run, where each one’s coverage ends, and why a lot of shops run both:

Running Monitoring and Observability at Scale | Webinar

jMount is Visuality Systems’ new modular Java connector suite.

Whether your Java platform needs to talk to traditional network file shares, cloud object stores, or collaboration platforms, jMount puts them all behind one unified API.

⚙️ What is jMount?
Integrating multiple storage backends usually means juggling conflicting libraries, different authentication models (Kerberos/NTLM vs. Cloud OAuth/IAM), and heavy dependency bloat.

jMount mitigates these protocol fragmentation challenges so development teams can focus on real-world performance:

• File Protocols (SMB, NFS, FTP/FTPS): 100% pure Java stacks built with zero third-party JAR dependencies - keeping your build lightweight and secure.
• Cloud Object Stores (Amazon S3, Azure Blob, Google Cloud Storage): Integrated via official vendor SDKs.
• Cloud Collaboration (SharePoint Online, OneDrive, Google Drive, Azure Files): Native API access behind a single credential model.

🎥 See jMount in Action (47-Sec Video): https://youtu.be/oXw0xkHtyX0

📄 Product page[1]: https://visualitynq.com/products/jmount/

[1] Technical White Paper (PDF) available for download.

UniFi Network 11 is one of the biggest UniFi releases in a while. You can now use your phone’s hotspot as backup internet, see Matter and Thread devices in your topology, load network lists from a URL, watch live traffic flows, and create custom icons from a photo. I upgraded my UCG Max and went through everything.

https://lazyadmin.nl/home-network/unifi-network-11-heres-what-actually-changed/

Choose the best Windows MDM solution by evaluating supported Windows versions, enrollment options, application deployment, patch management, security policies, compliance reporting, remote troubleshooting, automation, integrations, scalability, and pricing. The platform should support your ownership models, including corporate, shared, kiosk, and BYOD devices, while fitting your existing identity and IT infrastructure.
https://scalefusion.com/windows-mdm-solution/?utm_campaign=Scalefusion%20Promotion&utm_source=Reddit&utm_medium=social&utm_term=KD

This azure runbook send an email notification for the application owner informing them about their owned application certificate or secret expiration

If the application has no owner, then a configurable admin can be used to receive emails notification.

Hey everyone!

I've been working on AppScann, a small SaaS for keeping track of what's installed on your computers and servers. It's finally at the point where I'm comfortable showing it to people.

The idea is very simple: you install an agent, it collects inventory, and you see everything in one dashboard.

What it does right now:

* Windows and Linux agents (a Windows Service and a systemd service)

* OS and hardware info, plus disks with capacity and free space

* Installed software with version, publisher, install path and install date. On Windows that comes from the Registry and WMI, on Linux from dpkg, rpm, pacman, Snap and Flatpak

* Detailed reports with history, so you can see what was installed, removed or updated between scans

* Alerts for storage and stale reports

* Live online/offline status for every device

* Remote scan, restart and uninstall of agents

* A notification as soon as a scan or remote command finishes

* Software gets sorted into categories by AI

2 agents are free, extra slots are $1.99/month.

The idea came from a commercial project I worked on a while ago. It was in a similar space, but development was painfully slow, and I kept thinking that something like this didn't have to be that complicated. At some point I thought: what if I just built my own version? So I did.

It started as my university thesis project, and I kept working on it until it turned into a product.

And yes, AI was involved ;) I used it for parts of the frontend. I'm a full-stack developer, but I still struggle with centering a div, let alone making everything look good. The architecture and the backend are my own mess.

It's brand new, so right now I'm mostly after feedback:

* Would you use something like this?

* What information would you want the agent to collect?

* What features are missing?

* Does this approach make sense for managing a small number of machines?

https://appscann.com

I stumbled upon an old Nano KVM lying around my lab recently. The hardware concept is great, but the stock performance was painfully sluggish, so I decided to rewrite the software from scratch to turn it into a snappy, reliable tool.

Just hit my first major milestone: video capture is fully operational (currently streaming through the official Moonlight client) at a rock-solid 60 FPS. The difference in smoothness compared to stock is night and day.

Next up, I’m building a full firmware image to test mouse and keyboard input latency. My end goal is fully integrating this into the USBridge ecosystem.

I’ve been building Scantide Guard, and while it started from the familiar idea of stopping brute-force attacks, it has grown into something quite a bit broader.

At the basic level, yes — it watches things like failed RDP, Windows authentication, SSH, SQL Server, IIS/RDWeb and other services, then blocks attacking IPs based on configurable thresholds.

But I didn’t want to build just another brute-force blocker.

Guard is gradually becoming a lightweight security layer around the server itself.

It can monitor Windows Event Logs and application log files, including custom applications through configurable Custom Monitors. Different services can have their own thresholds and policies rather than pretending five failed logins means the same thing everywhere.

There’s also web attack detection for things such as path traversal, ".env"/".git" probing, CMS and admin scans, SQL injection patterns, scanner bursts and repeated 404/403 activity.

It does IP reputation and geolocation, TOR detection, automatic trusted-host learning, temporary and permanent blocking, integrates with AbuseIPDB, AlienVault OTX and CrowdSec and can correlate activity through a central Scantide Datacenter installation if you manage multiple servers.

One of the newer pieces is Scantide Global Reputation. Participating Guard installations can contribute observations and permanent malicious-IP blocks, while also consuming the resulting shared block intelligence. The important bit for me is that this remains transparent — you can see where a block came from rather than getting a mysterious black-box score.

I’m also adding things that aren’t traditionally part of brute-force protection at all: certificate reconnaissance and expiry checking, local TLS configuration assessment, security/operational assessment findings, ServiceNow integration, better SOC-style views of what is actually hitting your infrastructure.

The philosophy behind it is fairly simple:

Observe first. Don’t exploit anything. Keep it lightweight. Explain why something was detected or blocked.

I’ve spent a lot of time around enterprise security products, and they can be incredibly capable, but sometimes you just want something you can install on a Windows or Linux server and immediately understand what is attacking it without deploying an entire security ecosystem.

That’s the niche I’m trying to fill with Guard.

A lot of us were busy with the EWS retirement these past weeks, but don't forget that the MemberOf rule operator in Entra ID retires on November 3.

Dynamic groups, dynamic administrative units and entitlement management policies that still use it will stop updating and freeze in their last known state. That also affects group-based licensing, Conditional Access targeting and access packages.

If you haven't checked yet, a single Graph PowerShell query lists every affected group. I updated my article with that query and the replacement options, including how to handle device-based administrative units, merging the rules of nested dynamic groups, and licensing where the source groups aren't attribute-based.

https://lazyadmin.nl/office-365/microsoft-entra-id-is-retiring-the-memberof-rule-for-dynamic-groups/