Glances 4.5.8

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Glances 4.5.8 on Ubuntu 24.04 as the software version, select your Region, and choose Launch through EC2.

Choose m5.large, your key pair and a security group as described above. Glances is light, so a smaller instance is also fine.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=glances}]'

On Glances 4.5.8 on Ubuntu 24.04, the SSH user is ubuntu. Connect with your key pair:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes a few seconds. Then confirm that the three units are active:

systemctl is-active glances-web nginx glances-firstboot

active active active

Confirm that Glances listens on loopback only and that nginx serves ports 80 and 443:

sudo ss -tlnp | awk 'NR==1 || /glances|nginx|sshd/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer LISTEN 127.0.0.1:61208 users:(("glances")) LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) LISTEN 0.0.0.0:22 users:(("sshd"),("systemd")) LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:22 users:(("sshd"),("systemd")) LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx"))

/opt/glances/venv/bin/python -c 'import glances, psutil; print("Glances", glances.__version__, "/ psutil", psutil.__version__)'

Glances 4.5.8 / psutil 7.2.2

Read the credentials file:

sudo cat /root/glances-info.txt

The file holds the address Glances is served at (your instance's public DNS name by default), the user name glances and the password generated on this instance:

glances_url=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ glances_username=glances glances_password=<28 letters and digits>

Open glances_url in your browser. The certificate is self-signed and generated on your instance, so accept the browser warning once. Alternatively, install your own certificate (Step 9).

Your browser then asks for a user name and password. Enter glances and the password from Step 4.

The dashboard shows the instance at a glance. CPU, memory, swap and load are at the top. Network, disk I/O, file systems and sensors are on the left. Every process appears on the right, with its CPU and memory use, user and command line. The page refreshes every two seconds.

The dashboard supports the same single-key shortcuts as Glances in a terminal. Press m to sort the processes by memory, c by CPU, i by I/O, and a to return to automatic sorting.

Press h for the full list of shortcuts, which covers showing or hiding sections, switching units and clearing alerts.

Every value on the dashboard is also available as JSON under /api/4/, with the same user name and password. The interactive API documentation is at /docs.

On the instance, run the commands below to read the CPU statistics. The password goes to curl on stdin as a config line, so it never appears on a command line:

H=$(sudo sed -n 's#^glances_url=https://\([^/]*\)/#\1#p' /root/glances-info.txt)
sudo sed -n 's/^glances_password=\(.*\)$/user = "glances:\1"/p' /root/glances-info.txt \
  | curl -sk -K - --resolve "$H:443:127.0.0.1" "https://$H/api/4/cpu" | python3 -m json.tool | head -6

{ "total": 1.2, "user": 0.8, "nice": 0.0, "system": 0.3, "idle": 98.5,

List the plugins that are running:

H=$(sudo sed -n 's#^glances_url=https://\([^/]*\)/#\1#p' /root/glances-info.txt)
sudo sed -n 's/^glances_password=\(.*\)$/user = "glances:\1"/p' /root/glances-info.txt \
  | curl -sk -K - --resolve "$H:443:127.0.0.1" "https://$H/api/4/pluginslist"; echo

["quicklook", "sensors", "cpu", "ports", "fs", "wifi", "core", "load", "amps", "programlist", "help", "containers", "memswap", "version", "network", "uptime", "mem", "now", "ip", "psutilversion", "percpu", "diskio", "system", "alert", "folders", "processlist", "gpu", "processcount"]

From your own computer, use the instance's address and the password from Step 4. For example, run curl -k -u glances https://<your-host>/api/4/mem and enter the password when curl prompts for it.

Single values have their own paths, such as /api/4/mem/percent or /api/4/load/min1. /api/4/all returns everything at once.

Port 80 redirects browsers to HTTPS. The health endpoint answers without a password, so load balancers can check it. Everything else needs the password: a missing or wrong password is refused, and yours is accepted. Unknown host names are dropped:

H=$(sudo sed -n 's#^glances_url=https://\([^/]*\)/#\1#p' /root/glances-info.txt)
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/" curl -sk -w '\n' --resolve "$H:443:127.0.0.1" "https://$H/healthz" curl -sk -o /dev/null -w 'no password: %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/api/4/cpu" printf 'user = "glances:wrong-password-123"\n' | curl -sk -K - -o /dev/null -w 'wrong password: %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/api/4/cpu"
sudo sed -n 's/^glances_password=\(.*\)$/user = "glances:\1"/p' /root/glances-info.txt | curl -sk -K - -o /dev/null -w 'your password: %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/api/4/cpu" curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ ok no password: 401 wrong password: 401 your password: 200 unknown host name: 000

(000 means nginx closed the connection without an answer.)

The certificate was generated on this instance and names its own addresses:

H=$(sudo sed -n 's#^glances_url=https://\([^/]*\)/#\1#p' /root/glances-info.txt)
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

Glances runs unprivileged in a sandbox. Only its web server runs, on loopback. The cloud plugin, update check, autodiscovery and configuration commands are off. Neither Glances nor nginx can reach the instance metadata service:

systemctl show glances-web -p User -p NoNewPrivileges -p ProtectSystem -p IPAddressDeny
systemctl show nginx -p IPAddressDeny
systemctl show glances-web -p ExecStart | grep -oE 'glances -C [^;]*'

IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 User=glances ProtectSystem=full NoNewPrivileges=yes IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 glances -C /etc/glances/glances.conf -w --bind 127.0.0.1 --port 61208 --disable-plugin cloud --disable-check-update --disable-autodiscover --disable-config-exec

nginx checks the password, then passes Glances a fixed host name and the real client address from the connection. It never passes values a client sends, and it does not forward your credentials to Glances:

grep -E 'proxy_set_header (Host|X-Forwarded-For|X-Real-IP|Authorization)' /etc/nginx/sites-available/sac-glances | sort -u

proxy_set_header Authorization ""; proxy_set_header Host $gl_host; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr;

The SecureAnyCloud settings in the Glances configuration file:

sudo grep -E '^(check_update|cors_origins|cors_credentials|webui_allowed_hosts|public_disabled|port_default_gateway)=' /etc/glances/glances.conf

check_update=false cors_origins=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com cors_credentials=False webui_allowed_hosts=ec2-<public-ip-dashed>.<region>.compute.amazonaws.com,<public-ip>,<private-ip>,127.0.0.1,localhost public_disabled=True port_default_gateway=False

nginx also refuses a change whose Origin is another web site (HTTP 403), including a cross-site WebSocket connection. Glances itself rejects any Host that is not one of your instance's names, even from the instance.

Glances reads /etc/glances/glances.conf, the upstream configuration file with the SecureAnyCloud settings above. Edit it as root, then restart Glances:

sudo nano /etc/glances/glances.conf
sudo systemctl restart glances-web

Common changes:

• Alert thresholds. Each plugin section has careful, warning and critical levels (for example [mem] or [fs]). The dashboard colors values and lists alerts when a level is crossed.
• Service and URL checks. The [ports] section can check TCP ports and web URLs (port_1_host=, web_1_url=) and shows them under the network panel. The default gateway ping is off because the VPC router does not answer ping. Set port_default_gateway=True on networks where it does. These checks run inside Glances' sandbox, so they cannot reach the instance metadata service.
• Application monitoring. The [amp_*] sections group processes by application (nginx, systemd, and so on).
• Exporters. Sections such as [influxdb2], [prometheus] or [elasticsearch] configure where glances --export sends data. The image ships the web server only, and an exporter needs its Python client library, which is not installed.

Keep two behaviors as shipped unless you have a reason to change them. --disable-config-exec in the service means backtick commands in the configuration file are not run. Alert action commands also cannot chain or redirect with shell operators.

Glances runs as the unprivileged glances user. On a standard instance, everything on the dashboard works that way. Running it as root would add per-process I/O counters for other users' processes.

To show Docker container statistics, add the user to the docker group once Docker is installed (sudo usermod -aG docker glances, then restart glances-web). Membership of that group is equivalent to root, so do this only if you need the containers panel.

Point a DNS record at the instance, then set the name Glances is served as. The command below mints a new self-signed certificate for that name. It updates nginx, Glances' allowed host names, the cross-origin address and the URL in /root/glances-info.txt. The name persists across reboots:

sudo glances-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running glances-set-hostname again replaces it with a self-signed certificate:

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/glances.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/glances.key
sudo nginx -t && sudo systemctl reload nginx

glances-set-password sets a new password for the glances sign-in and records it in /root/glances-info.txt. Run it without arguments for a new random password, or pass your own (16 to 128 letters and digits) on stdin:

sudo glances-set-password printf '%s\n' '<your-new-password>' | sudo glances-set-password --stdin

To give several people their own sign-in, add users to the nginx password file with htpasswd, which asks for each password. Keep the file readable by nginx only, then reload nginx. Note that glances-set-password rewrites the file with the glances user alone.

sudo htpasswd -B /etc/nginx/glances.htpasswd <name>
sudo chown root:www-data /etc/nginx/glances.htpasswd && sudo chmod 0640 /etc/nginx/glances.htpasswd
sudo systemctl reload nginx

Glances is installed in its own virtual environment from exact, hash-verified wheels. pip has been removed from the environment, so nothing changes it by accident. The image ships the version named in the listing.

To move to a newer Glances release later, follow these steps:

• Snapshot the instance.
• Create a new virtual environment next to the old one (python3 -m venv /opt/glances/venv-new) and install the release you want into it.
• Point ExecStart in /etc/systemd/system/glances-web.service at the new environment.
• Run sudo systemctl daemon-reload && sudo systemctl restart glances-web.

Where each component lives:

• Glances 4.5.8: /opt/glances/venv (glances-web.service, user glances, 127.0.0.1:61208)
• Glances configuration: /etc/glances/glances.conf
• nginx site: /etc/nginx/sites-available/sac-glances
• Password file (bcrypt): /etc/nginx/glances.htpasswd
• Certificate and key: /etc/nginx/ssl/
• First boot script: /usr/local/sbin/glances-firstboot.sh
• Host name and password helpers: /usr/local/sbin/glances-set-hostname, /usr/local/sbin/glances-set-password
• Credentials: /root/glances-info.txt (mode 0600)
• License and source record: /usr/share/doc/glances/

• Allow ports 22, 80 and 443 in the security group from your own networks only, and never open port 61208.
• Treat the dashboard password like an administrator password, because the process list shows the command lines of everything on the instance. Rotate it if it may have been shared (Step 10).
• Use your own DNS name and a certificate your browsers trust (Step 9).
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.