C.W.K.
Stream
Lesson 02 of 04 · published

The Machines, Not Just the Apps

~9 min · scope, machines-not-apps, observability, layers

Level 0Lone Machine
0 XP0/37 lessons0/12 achievements
0/100 XP to next level100 XP to go0% complete
"The app being up is good news about the app. It tells you almost nothing about the machine underneath it."

The tempting narrow scope

Say fleet control plane and most people picture app monitoring: is the web service up, is the queue draining, are the containers healthy. That's real and useful — but it's a subset. It watches the top floor of the building and calls it the building.

The subject is the computer

Watchfire's subject is one layer down: the Mac itself. Which OS build it runs. Whether it's an enrolled member of the fleet or just some device on the network. Whether it's reachable, and by which path. Whether its environment has drifted — shell, packages, config, background jobs. Whether the services it's supposed to run are actually loaded. The applications are one of those signals, consumed through a health contract — not the boundary of the job.

Why the wider scope earns its keep

The day your app is down, the cause is often a floor below it: the machine fell behind on an OS update and a dependency broke, or it lost its SSH path after a network change, or its environment drifted and a background job quietly stopped. App monitoring sees the symptom and shrugs at the cause. A control plane whose subject is the machine can see the OS build, the reachability, the drift, and the dead launchd job in one breath — and tell you which one actually broke.

Consume, don't absorb

There's a discipline hidden in here: Watchfire consumes a sibling engine's documented health — are you up? are you serving? — but it does not copy that engine's internal diagnostics or restart logic into itself. The machine layer stays its own; the app layer stays the app's. Watchfire asks the app how it feels; it never tries to become the app's doctor.

Manage the floor the problem actually lives on. If you can only see the top floor, every basement fire looks like a mystery on the top floor.

Code

One observation, many layers·json
{
  "host_id": "server",
  "observed_at": "2026-07-19T04:12:07Z",
  "reachable": { "tailscale": true, "ssh": true },
  "os": { "product": "macOS", "build": "25F84" },
  "resources": { "disk_free_gb": 812, "uptime_days": 6 },
  "services": [
    { "name": "backup-agent",  "expected": true, "loaded": true },
    { "name": "nightly-sync",  "expected": true, "loaded": false }
  ],
  "env_drift": ["shell config newer than fleet baseline"]
}
// The app signal (services[]) is ONE field among reachability, OS,
// resources, and drift. The machine is the subject; the app is a column.

External links

Exercise

Pick an app you run on your own machine. Write down three ways the app could look 'up' in its own logs while the machine underneath it is quietly broken (disk almost full, wrong OS build, a dependency that stopped autostarting). For each, ask: would app-only monitoring ever catch it?
Hint
The app answers 'am I running?'. The machine answers 'for how much longer?'. A process can look perfectly healthy on a disk with 30 MB left.

Progress

Progress is local-only — sign in to sync across devices.
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign inPlease sign in to comment.

No comments yet — be the first.