Get early access
Features · Discovery & Mapping · Config Watch
Discovery & Mapping · Config Watch

Drift detection,
without an Ansible audit.

Pick the files that define your fleet — nginx vhosts, sshd_config, fstab, sudoers — and HostAtlas tracks every change, surfaces the diff and alerts when something drifts away from the rest of the group.

tracked config · web-prod-04
/etc/nginx/nginx.conf changed 2h ago
+ client_max_body_size 64M
- client_max_body_size 8M
/etc/php/8.3/fpm/php.ini unchanged 14d
/etc/ssh/sshd_config unchanged 61d
— Why this matters

Most outages start with a file someone edited.

01

Hashes, not guesses.

SHA-256 every five minutes. A change is a fact, not an inference from behaviour that got worse.

02

Some files deserve an incident, not a notification.

sshd_config, sudoers, passwd and shadow open an incident by themselves. The rest raise an event you can route as you like.

03

A baseline on start means no false first alarm.

The agent captures what is there when it arrives, so day one is quiet.

— What's included

What is watched and what you see.

18 paths by default
nginx.conf, my.cnf, postgresql.conf, pg_hba.conf, redis.conf, php.ini, www.conf, sshd_config and the rest of the usual suspects.
Your own paths too
Configured per server, with glob support — /etc/nginx/sites-enabled/* works.
Snapshots kept
Content and hash, so history is real rather than a list of timestamps.
Side-by-side diff
Previous against current, which is the only view that answers "what changed".
Critical files escalate
Changes to the security-relevant four open an incident automatically.
Large files skipped
Anything over a megabyte is left alone rather than snapshotted.
— How it works

Hash, compare, decide.

1

Baseline on enrol

The first snapshot is taken when the agent starts, so a fresh host does not alarm about files it has simply never seen before.

2

Hash on a schedule

Each watched path is hashed and compared to the last hash. A changed hash is the only thing that triggers work — nothing is diffed blindly.

3

Diff, then route by path

The stored snapshot gives a side-by-side diff. Paths you marked critical escalate; the rest send a notification and wait.

— Works with

Connected capabilities

Server Auto-Discovery
How we know which files matter on a given host — nginx is only relevant if the box runs nginx.
→
Domain Discovery
Watched vhost files feed domain discovery — config change → domain rediscovery.
→
Audit Log
Every drift event also appears in the platform audit log.
→
Smart Alerts
Build alert rules on top of drift events.
→
— FAQ

Questions, answered honestly.

Are file contents stored on your servers? +
Yes — encrypted at rest, tenant-scoped. Hashes are computed first; full content stored only for paths under the configured size limit (default 1 MB per file).
Can I exclude secrets? +
Add path globs to /etc/hostatlas/redact.yml. Matching files have their content replaced with a [redacted × sha256] marker but are still diffed by hash.
Does it watch binaries? +
No — Config Watch is for text. For package + binary version drift use Vulnerability Scanning's SBOM.

Catch the change that broke prod.

Available from Starter; defaults ship with sensible paths.

Get early access Back to Discovery & Mapping