Every container streams its logs to the dashboard in real time via the Docker API. Filter by individual container — nginx, PHP, Redis, MariaDB — or view the merged stream across all services. Shared collector pattern multiplexes one Docker connection to all subscribers.

Application-level logs from the host filesystem are streamed directly via SSH tail. This includes Magento's system.log, exception.log, and custom log files. One SSH process per instance is multiplexed to all subscribers for efficient delivery.

A lightweight monitoring agent runs as a background service on each host, gathering CPU, memory, disk, I/O, and network metrics at 5-second intervals. Metrics are pushed via WebSocket — no HTTP polling overhead, with historical retention for trend analysis.

SIEM agents continuously monitor for security events and push alerts to Discord and email. CVE scanning checks installed packages against known vulnerability databases. Active response rules automatically block IPs or restart services when threats are detected.

WebSocket-powered SSH terminal running in the browser with a persistent buffer surviving page navigation. No local SSH client, key management, or VPN required. Secured via private encrypted mesh — terminal traffic never traverses the public internet.

Each environment includes container orchestration monitoring, per-second system performance graphs, and the threat intelligence dashboard for threat intelligence — blocked IPs, attack patterns, and community-shared threat feeds.