个人Linux服务器监控方案汇总：从零到够用
你有一台个人 VPS，1核2G那种，挂着博客、代理、小服务。要不要监控？
要。但你知道企业和个人的区别：企业监控是工作，个人监控是爱好。 爱好不能占用工作的时间，也不能吃掉服务器本就不多的内存。
这篇文章不是教你搭一套 Prometheus + Grafana + 告警三件套——那是给公司运维团队看的。这篇文章是给你——一个手里有台低配 VPS 的程序员——看的。
我个人有一台香港 VPS：2核E5、1.5GB内存、34GB SSD、5Mbps带宽。Ubuntu 24.04。上面跑着博客、代理、几个小服务。所有监控方案我都在这台机器上试过。下面是我翻过的车和最终留下的方案。
第一梯队：闭着眼装，不占资源
这几个工具加起来占用不到 50MB 内存。没有任何理由不装。
htop / btop
作用：看当前进程，CPU/内存/磁盘/网络实时状态。
占用：10-25MB（交互时）
安装：apt install btop
htop 是老面孔了，btop 是它的美化版——带色阶、带图表、支持鼠标点击。二选一的话，btop 现在更值得用。
apt install btop
btop
它不是监控，是诊断工具。服务器出问题的时候你的第一反应是打开它。平时没必要一直开着。
vnstat
作用：流量统计。每天、每月用了多少流量，一目了然。
占用：2-5MB（daemon 常驻）
安装：apt install vnstat
5Mbps 带宽的 VPS，流量是稀缺资源。vnstat 告诉你这个月跑了多少、哪天流量异常。没有它你连自己被 DDoS 了都不知道。
# 安装后启动
systemctl enable vnstat --now
# 查看流量
vnstat -d # 每日
vnstat -m # 每月
vnstat -l # 实时
fail2ban
作用：扫描登录失败日志，封禁暴力破解 IP。
占用：10-20MB
安装：apt install fail2ban
这个我专门写过配置——sshd jail，maxretry=2，bantime=10天。不装的话，你的 SSH 端口每天被扫几百次是常态。
smartmontools
作用：监控硬盘健康状态——SMART 属性、自检。
占用：1-3MB（daemon 常驻）
安装：apt install smartmontools
VPS 的 SSD 也是会坏的。供应商不提醒你，smartmontools 会。
smartctl -a /dev/sda | grep -E 'Reallocated|Pending|Current_Pending|Offline_Uncorrectable'
这四个值只要有一个非零，说明你的硬盘正在死亡。
这四件套装完，你已经覆盖了 80% 的基础监控需求。占用不到 50MB，不要有心理负担。
第二梯队：按需上一到两个
Netdata（推荐首选）
一句话定位：零配置的实时监控面板，打开浏览器就能看到所有指标，精确到每秒。
占用：80-150MB
安装：apt install netdata
Netdata 是我在 1.5GB VPS 上最后留下来的"大件"。它不用配数据库、不用配可视化——装完打开 19999 端口就能看。CPU、内存、磁盘、网络、进程、系统负载、TCP 连接数——全有。还有内置告警（CPU 超过 80% 会响）。
为什么留它没留其他？因为它的资源效率是最高的。Prometheus+Grafana 全套跑下来要 150-250MB，Netdata 一个进程搞定，给的图表甚至更细（每秒采样 vs Prometheus 默认 15 秒）。
apt install netdata
# 默认监听 localhost:19999
# 想从外网访问的话改 /etc/netdata/netdata.conf 的 bind to = 0.0.0.0
# 但建议用 nginx 反代加密码
弱点：图表太多太细，刚开始可能觉得眼花。习惯之后你会发现这就是它的优点——你想看的东西全在，不用配。
适合谁：想一眼看清楚服务器所有状态的人。不适合：对"实时"没需求，只看每天摘要就够了的人。
Cockpit
一句话定位：Web 版的服务器管理面板——能看系统状态、操作 systemd 服务、看日志、甚至开终端。
占用：40-70MB
安装：apt install cockpit
Cockpit 和 Netdata 最大的区别是：Cockpit 让你操作，Netdata 让你看。 在 Cockpit 里你可以重启服务、查看 journal 日志、管理存储、甚至直接在浏览器里开一个终端会话。对不习惯频繁 SSH 的人来说很方便。
apt install cockpit
# 默认 9090 端口，用系统账号登录
弱点：没有历史数据，没有告警，更像一个 Web 版的 SSH + 系统信息查看器。和 Netdata 不冲突——它们互补。
第三梯队：日志和安全
logwatch
作用：每天晚上给你发一封邮件，汇总今天的系统日志——谁登录了、哪里失败过、磁盘有没有异常。
占用：0MB（cron 跑完就退）
安装：apt install logwatch
logwatch 没有常驻进程，它是每天凌晨跑一个 cron job，分析日志后给你发邮件。
# 格式：apt install logwatch, 配置邮箱即可
# 默认输出很详细，建议调成 --detail Low 减少噪音
GoAccess
作用：如果你跑 Nginx/Apache，它实时分析访问日志——访客 IP、请求路径、状态码、浏览器、地理位置。
占用：10-30MB（交互时）
安装：apt install goaccess
# 实时模式
goaccess /var/log/nginx/access.log -c
# 生成静态 HTML 报告（省资源）
goaccess /var/log/nginx/access.log -o report.html --log-format=COMBINED
我自己的用法：每个月跑一次生成 HTML 报告，看一眼访问趋势，然后删掉。不常驻运行。
第四梯队：外部监控
Uptime Kuma
作用：从外部检查你的服务是不是活着——HTTP ping、TCP ping、证书过期提醒。 占用：50-100MB（Node.js 进程） 安装：Docker 或 npm
对个人 VPS 来说，内部监控只能告诉你"服务器还活着"，外部监控才能告诉你"别人能不能访问到你的服务"。
docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:latest
占用不小（Node.js 嘛），但它是外部监控，可以部署在另一台机器上。如果只有一台 VPS，建议放生——或者只在需要的时候启动。
第五梯队：好看但用不上（为什么你没选它们）
Prometheus + Grafana
这是企业标配，但对个人 VPS 来说存在三个问题：
- 资源占用 130-230MB——你的 1.5GB 机器跑个博客+数据库已经去了大半
- 配置复杂——你至少需要 Prometheus + node_exporter + Grafana 三个组件，每个都需要配
- 15 秒采样周期——对单台机器来说，Netdata 的每秒采样反而更好看
Telegraf + InfluxDB
同样的问题：InfluxDB 的 RAM 会随数据量增长。单个 VPS 不值得跑一个时序数据库。
Pi-hole
DNS 广告过滤，很强大，但 FTLDNS 要占 80-120MB。对 1.5GB 机器来说，hblock（静态 host 文件方案）更实用——零占用、cron 更新域名列表。缺点是不能动态开关。
我的方案（1.5GB VPS 上实际跑的）
| 工具 | 内存 | 作用 | 是否常驻 |
|---|---|---|---|
| htop/btop | 按需 | 临时诊断 | 否 |
| vnstat | 3MB | 流量统计 | 是 |
| fail2ban | 15MB | 安全防护 | 是 |
| smartmontools | 2MB | 硬盘监测 | 是 |
| Netdata | 100MB | 实时监控 | 是 |
| logwatch | cron | 日志摘要 | 否 |
| GoAccess | 按需 | 访问分析 | 否 |
合计常驻内存：约 120MB。在 1.5GB 的机器上，给博客、数据库、代理留了充足的空间。
这套方案的逻辑：你不可能用到的就不装，装了的尽量一个进程干多个活。 Netdata 把 CPU/内存/磁盘/网络/进程全部包了，不需要再加其他采集器。logwatch 是定时任务不占常驻。vnstat+smartmontools+fail2ban 是系统自带的，几 MB 不心疼。
监控不是为了好看。监控是为了在你睡觉的时候，服务器出问题了它替你骂一声。
所以选监控工具之前，先问自己一个问题：出问题了，你希望它怎么通知你？
- 看面板 → Netdata
- 收邮件 → logwatch
- 手机通知 → Uptime Kuma + Telegram Bot
- 查日志 → GoAccess
选一个核心方案，其他的都是点缀。别跑全套企业方案在个人 VPS 上——你不是 SRE，它也不是生产集群。
Personal Linux Server Monitoring: From Bare Minimum to Good Enough
You have a personal VPS. 1 core, 2GB RAM. Running a blog, a proxy, a few small services. Should you monitor it?
Yes. But there's a difference between enterprise and personal monitoring: Enterprise monitoring is your job. Personal monitoring is your hobby. A hobby shouldn't consume too much of your time or eat up your server's limited memory.
This article isn't about deploying Prometheus + Grafana + Alertmanager — that's for corporate ops teams. This article is for you — a programmer with a cheap VPS and a desire to know what's happening without losing sleep over configuration files.
I have a Hong Kong VPS: 2-core E5, 1.5GB RAM, 34GB SSD, 5Mbps bandwidth. Ubuntu 24.04. Blog, proxy, several small services. I've tried every monitoring solution on this machine. Here's what broke and what stayed.
Tier 1: Install Blindly, Zero Regret
These tools combined use under 50MB of RAM. There's no reason not to install them.
htop / btop
What: Real-time process viewer with CPU/mem/disk/network stats.
RAM: 10-25MB (interactive)
Install: apt install btop
htop has been around forever. btop is the prettier successor — color gradients, graphs, mouse support. Pick btop.
apt install btop
btop
This isn't monitoring — it's diagnostics. It's what you open when something feels wrong. No need to keep it running.
vnstat
What: Network traffic statistics. How much data you've used today, this month.
RAM: 2-5MB (daemon)
Install: apt install vnstat
On a 5Mbps VPS, bandwidth is precious. vnstat tells you if you're being DDoSed or if a cron job went rogue.
systemctl enable vnstat --now
vnstat -d # daily
vnstat -m # monthly
vnstat -l # live
fail2ban
What: Scans failed login logs, bans brute-forcing IPs.
RAM: 10-20MB
Install: apt install fail2ban
Without it, your SSH port gets scanned hundreds of times a day. With it, those IPs get 10-day bans after 2 failed attempts.
smartmontools
What: Hard drive health monitoring — SMART attributes, self-tests.
RAM: 1-3MB (daemon)
Install: apt install smartmontools
VPS SSDs die too. Your provider won't warn you. smartmontools will.
smartctl -a /dev/sda | grep -E 'Reallocated|Pending|Current_Pending|Offline_Uncorrectable'
Any non-zero value means your disk is failing.
This four-piece set covers 80% of your basic monitoring needs. Under 50MB total. Install them.
Tier 2: Pick One or Two
Netdata (Recommended First Pick)
One-liner: Zero-config real-time monitoring dashboard. Open a browser and see every metric, updated every second.
RAM: 80-150MB
Install: apt install netdata
Netdata is the "big" tool I kept on my 1.5GB VPS. No database setup, no visualization config — install it, open port 19999, and everything is there. CPU, memory, disk, network, processes, system load, TCP connections. Built-in alerts (CPU over 80% triggers a notification).
Why Netdata over the alternatives? Best resource efficiency. Prometheus+Grafana takes 150-250MB. Netdata does it in one process with finer granularity (per-second vs Prometheus's default 15-second scrape interval).
apt install netdata
# Default: localhost:19999
# For remote access, change bind to in /etc/netdata/netdata.conf
# But proxy it through nginx with auth
Weakness: Too many charts at first. Once you get used to it, you realize that's the point — everything you might want to see is already there, no configuration required.
Best for: Someone who wants to glance at server status anytime. Not for: someone who only wants daily summaries.
Cockpit
One-liner: Web-based server admin panel — system status, service management, log viewer, even a browser terminal.
RAM: 40-70MB
Install: apt install cockpit
The difference between Cockpit and Netdata: Cockpit lets you act, Netdata lets you observe. In Cockpit you can restart services, browse journal logs, manage storage, and open a terminal in your browser. Great for people who don't want to SSH in for every admin task.
apt install cockpit
# Port 9090, login with system credentials
Weakness: No historical data, no alerting. More of a web-based SSH + system info viewer than a monitoring tool. Complements Netdata well.
Tier 3: Logs and Security
logwatch
What: Sends a daily email summarizing system logs — who logged in, what failed, disk anomalies.
RAM: 0MB (cron, exits after running)
Install: apt install logwatch
No daemon. It's a cron job that runs at dawn, parses logs, and emails you a digest.
apt install logwatch
# Default output is verbose; set --detail Low to reduce noise
GoAccess
What: Real-time Nginx/Apache log analyzer — visitor IPs, request paths, status codes, geolocation.
RAM: 10-30MB (when running)
Install: apt install goaccess
# Live mode
goaccess /var/log/nginx/access.log -c
# Generate static HTML report (lower overhead)
goaccess /var/log/nginx/access.log -o report.html --log-format=COMBINED
My usage: run it once a month to generate an HTML report, glance at traffic trends, then delete the report. No daemon.
Tier 4: External Monitoring
Uptime Kuma
What: Checks from outside whether your services are alive — HTTP ping, TCP ping, certificate expiry alerts. RAM: 50-100MB (Node.js) Install: Docker or npm
Internal monitoring tells you "your server is running." External monitoring tells you "can anyone actually reach it?"
docker run -d --restart=always -p 3001:3001 \
-v uptime-kuma:/app/data --name uptime-kuma \
louislam/uptime-kuma:latest
Not lightweight (Node.js overhead), but it's an external monitor — deploy it on another machine if you have one. On a single VPS, use it sparingly.
Tier 5: Looks Good, Doesn't Fit (Why You Didn't Choose These)
Prometheus + Grafana
The enterprise standard, but three problems for a personal VPS:
- 130-230MB RAM — your 1.5GB box is already running a blog and database
- Complex setup — Prometheus + node_exporter + Grafana, each needs configuration
- 15-second scrape interval — Netdata's per-second sampling actually looks better on a single machine
Telegraf + InfluxDB
Same issue: InfluxDB's RAM grows with data volume. A single VPS doesn't need a dedicated time-series database.
Pi-hole
Powerful DNS-level ad blocking, but FTLDNS consumes 80-120MB. For a 1.5GB VPS, hblock (static hosts file approach) is more practical — zero daemon overhead, cron-based updates. The trade-off: no dynamic on/off switching.
My Setup (Running on a 1.5GB VPS)
| Tool | RAM | Purpose | Daemon? |
|---|---|---|---|
| htop/btop | on demand | Diagnostics | No |
| vnstat | 3MB | Bandwidth tracking | Yes |
| fail2ban | 15MB | Security | Yes |
| smartmontools | 2MB | Disk health | Yes |
| Netdata | 100MB | Real-time monitoring | Yes |
| logwatch | cron | Log digest | No |
| GoAccess | on demand | Access log analysis | No |
Total persistent RAM: ~120MB. Leaving plenty of room for the blog, database, and proxy.
The philosophy: Don't install what you won't use. When you do install, make one process cover multiple jobs. Netdata handles CPU/memory/disk/network/processes in a single dashboard — no need for additional collectors. logwatch is a cron job with zero persistent footprint. vnstat + smartmontools + fail2ban are system utilities at a few MB each.
Monitoring isn't about having pretty dashboards. Monitoring is about knowing when something breaks while you're asleep.
Before choosing a monitoring setup, ask yourself one question: When something goes wrong, how do you want to be notified?
- Dashboard glances → Netdata
- Email digest → logwatch
- Phone notification → Uptime Kuma + Telegram Bot
- Log investigation → GoAccess
Pick one core approach. Everything else is garnish. Don't run the full enterprise stack on your personal VPS — you're not an SRE, and it's not a production cluster.