What it is
Wuthering Veil is a self-hosted control plane for monitoring Linux hosts and collecting security signals from them. You run a central server and dashboard on infrastructure you control; a lightweight C++ agent runs on each machine you want watched. Nothing is sent to a vendor cloud.
The agent polls the host on a fixed interval (default 5s, adjustable per host from the UI), builds a JSON payload of system metrics and security events, and POSTs it to the server. The server registers the host, stores metric history in memory, indexes security events for search, evaluates correlation rules for alerts, and pushes live updates to connected dashboards over Server-Sent Events. The ingest response can change the agent's poll interval and queue remote commands — block or kill a listening port, for example.
The dashboard is a React web app (nginx + Docker) or a Tauri desktop binary. Both talk to the same Rust API. Auth is a bearer token on every request. There is no multi-tenant SaaS layer — one deployment, your fleet.
wv-agent
C++17 binary installed natively on each Linux host via systemd. Reads /proc and /sys for CPU, memory, disk, network interfaces, process list, and systemd unit state. Parses auth logs and network tables for security heuristics — failed logins, new listening ports, file integrity changes, suspicious process lineage, and 11 other event types. Loads optional .so plugins from a directory; each plugin implements a small C API and returns custom metrics as JSON on every cycle. Not designed to run inside a container — it needs host-level access for procfs, log files, iptables, and dlopen.
wv-server
Rust/Axum HTTP API. SQLite for host records and SIEM event storage. In-memory ring buffers hold recent metric samples per host for charting. A built-in alert engine fires on patterns like brute-force login bursts or privilege escalation chains. SIEM endpoints support full-text search, filtering by event type, severity, hostname, and time range; retention is tiered (7 days free, 90 days enterprise). Host limits enforced at ingest via signed WV_LICENSE token — free tier allows one hostname, enterprise removes the cap.
Dashboard
Command Center shows fleet-wide status: online/offline/warning/critical counts, host table, open alerts, and a live security signal matrix. Click a host for per-host detail — metric history charts, disk mounts, top processes, services, network interfaces, security timeline, website uptime checks, and plugin output. Separate SIEM page for cross-fleet event search. Alerts page lists correlation hits with acknowledge actions. Dark UI with interchangeable presets; sheet or modern layout modes.
Topology
Typical layout: one wv-server instance (Docker Compose stack or embedded in the desktop app) reachable over HTTPS from agents and operators. Agents on each monitored host point WV_SERVER_URL at that server and authenticate with a shared ingest key. Desktop edition bundles server + UI locally and monitors one host. Server edition scales to a fleet — enterprise license required beyond one agent.
Stack: C++17 agent · Rust/Axum server · React dashboard · SQLite · SSE. Linux amd64 for v1.0.1.
Architecture
Three main components talk over HTTP:
Agentwv-agentC++17 · on each host
POST /api/v1/ingest
interval, commands
Serverwv-serverRust/axum
GET /api/v1/* + SSE stream
DashboardDashboard UITauri desktop or React web
Agent (wv-agent) — C++17, runs natively on Linux
The agent is intentionally not containerized. It needs direct access to kernel interfaces: /proc and /sys for CPU, memory, processes, network; parsing of auth logs, audit trails, and network tables for security events; iptables for remote port blocking; dlopen for loading plugin shared libraries.
Every N seconds (configurable from the dashboard, default 5s), the agent collects a full host metrics snapshot, runs security heuristics and emits discrete events, calls each loaded plugin's wv_plugin_collect(), POSTs everything as JSON to the server, and reads the response for interval updates and pending commands (kill port, block/unblock via firewall).
Configuration via CLI flags or environment variables: WV_SERVER_URL, WV_API_KEY, WV_INTERVAL, WV_PLUGIN_DIR.
Server (wv-server) — Rust (axum, tokio, SQLite)
The server ingests agent payloads and registers hosts by hostname; evaluates host status (online / warning / critical / offline) from metric thresholds; generates alerts when thresholds are crossed, with deduplication; stores host registry, metric history, security event queues, website check configs, and blocked-port state in SQLite; streams live updates to the UI via Server-Sent Events (SSE); queues commands for agents to pick up on their next ingest cycle.
It can run standalone (Docker / headless) or be embedded inside the Tauri desktop app on port 18080.
Dashboard — React + TypeScript
The same React UI ships in two forms: Desktop (Tauri) — native window; Rust backend embeds wv-server locally. Data in ~/.local/share/... — and Web — Vite dev server or nginx SPA pointing at a remote wv-server.
Authentication is a simple admin login. The UI connects to the server API and subscribes to SSE for live refresh.
Monitoring capabilities
Host metrics (every ingest cycle)
| Category | Data collected |
|---|
| CPU | Usage %, 1/5/15 load averages, core count |
| Memory | Total, available, swap, usage % |
| Disks | Per-mount usage, filesystem type |
| Network | Per-interface RX/TX bytes and packets |
| Processes | Top processes by RSS |
| Services | systemd unit states |
| Ports | All listening TCP/UDP sockets with PID and process name |
| Uptime | Seconds since boot |
Metric history is stored server-side and rendered as area charts on each host's Overview tab.
Security monitoring
The agent implements a SOC-lite layer — 15 security event categories mapped to common attack patterns:
| Event type | What it detects |
|---|
| Failed logins | SSH/auth brute-force spikes |
| Successful logins | Logins outside normal patterns |
| Privilege escalation | sudo/su usage |
| New listening ports | Unauthorized services opening sockets |
| Outbound volatility | Sudden spikes in outbound connections |
| Data exfiltration | High outbound bytes, low inbound |
| DNS failures | Unresolved domain request spikes |
| Suspicious processes | Unsigned or unusual binaries |
| Abnormal binaries | Encoded admin tool usage |
| Process lineage | Invalid parent→child relationships |
| Cryptomining | Sustained high CPU in user-space |
| File integrity | Changes in critical directories (/etc, etc.) |
| Persistence changes | cron/systemd startup modifications |
| Unsigned kernel modules | Unverified LKM injection |
| Security policy disabled | Firewall/audit logging tampering |
Events appear in three places:
- Fleet Command Center — security tab with a 15-cell signal matrix (counts at a glance)
- Host Security tab — full matrix, totals, grouped/ungrouped event feed with expandable duplicates
- Alerts panel — threshold-generated alerts alongside security events
Operators can clear a host's security event history from the UI.
Operational features
Configurable metric interval
Per-host polling interval (1s–3600s) set from the dashboard; the server pushes the new value back on the agent's next check-in.
Listening port management
From a host's Overview tab, operators can block a port (agent adds an iptables DROP rule), unblock a previously blocked port, or kill the process listening on a port (SIGTERM → SIGKILL). Commands travel server → agent via the ingest response channel — no separate agent daemon or SSH required.
Website monitoring
Per-host URL checks configured in the UI. The server probes URLs (response time, HTTP status, up/down) on a configurable interval and stores history with sparkline charts.
Plugin system
Developers build .so shared libraries implementing a small C API (wv_plugin_name, wv_plugin_collect, etc.). The agent loads them from a plugin directory at startup and includes their JSON output in every ingest. The dashboard Plugins tab renders scalar metrics as tiles and nested data as JSON — no core app changes needed. An example plugin ships with the repo (logged-in users, kernel version, entropy).
User interface
The dashboard is built for operators who stare at it for hours:
Sheet style (default) — flat, data-dense, horizontal dividers, table rows, ticker strips; ops-terminal aesthetic
Modern style — rounded cards, larger stat numbers, padded layout
Themes — dark (default) and light
Color presets — Default, Midnight, Rich, Vivid, Royal (each with distinct background/accent pairings)
Typography — Space Grotesk (UI), Bebas Neue (numbers), JetBrains Mono (labels/code)
Accent — Imperial Red #FB3640
| View | Purpose |
|---|
| Command Center | Fleet summary, host list/table, alerts + security side panel |
| Host Detail → Overview | Stats, charts, disks, processes, services, network, port manager |
| Host Detail → Security | 15-signal matrix, event feed with grouping |
| Host Detail → Websites | Add/remove URL checks, response-time history |
| Host Detail → Plugins | Custom agent plugin output |
| Alerts | Full alert list with acknowledge |
Live updates via SSE — no manual refresh.
Deployment models
Desktop app (primary dev workflow)
cd desktop && npm run tauri dev # embedded server on :18080
cd agent && ./build/wv-agent --server http://127.0.0.1:18080 --key dev-agent-key
Headless server + browser
cd server && cargo run # :8080
cd web && npm run dev # Vite → server
Docker Compose (production)
Server container + nginx serving the pre-built SPA. Agents run natively on each host (not in Docker) so they retain /proc access. Agents install via systemd unit (wv-agent.service) with WV_SERVER_URL, WV_API_KEY, WV_PLUGIN_DIR.
Technology stack
| Layer | Technology |
|---|
| Agent | C++17, CMake, procfs/sysfs, dlopen plugins |
| Server | Rust, axum, tokio, sqlx/SQLite, reqwest (website probes) |
| Desktop shell | Tauri 2 (embeds server as library) |
| Frontend | React 19, TypeScript, Vite, Tailwind CSS 4, Recharts |
| Transport | HTTP JSON ingest, SSE for live UI |
| Storage | SQLite (hosts, history, alerts, website results) |
Data flow summary
- Agent collects metrics + security events + plugin data → JSON POST
- Server parses, updates host record, appends history, evaluates alerts, stores security events, returns
{ interval_seconds, commands[] }
- Agent applies interval change and executes commands
- Server broadcasts SSE event
- Dashboard refetches and re-renders
Wuthering Veil is a self-hosted Linux fleet monitor with built-in security signal detection, remote port control, website uptime checks, and an extensible agent plugin system — delivered as a native desktop app or web dashboard backed by a Rust API server and lightweight C++ agents.
