RCC Sentinel Documentation

📖 What is RCC Sentinel?

RCC Sentinel is a lightweight, transparent SaaS monitoring console designed specifically for Windows Server 2016 and later VPS environments. It provides real-time visibility into resource utilisation, active RDP sessions, firewall status, running processes, Windows services, and a full audit trail of administrative actions — all from a single web-based dashboard.

Unlike heavyweight enterprise agents that consume hundreds of megabytes of RAM, the RCC Sentinel agent is a single PowerShell script that runs as a Windows service and typically uses under 3 MB of memory. The entire agent code is readable and auditable before deployment.

How It Works

The system has three components:

1. Central Console — The secure SaaS platform hosting the monitoring dashboard, managing alerts, and orchestrating secure clientless RDP sessions.
2. Windows Agent — A PowerShell script installed as a Windows service on each monitored VPS. It listens on a configured local port and responds to authenticated queries with live system data.
3. Web Dashboard — A browser-based UI that displays all metrics from all nodes in a single view. Accessible from any device after login.

The central console polls each registered VPS agent every 30 seconds using HTTP requests authenticated with a unique per-server API key. The agent responds with a JSON payload containing CPU, RAM, disk, network connections, running processes, service states, and Windows event log entries.

System Requirements

🚀 Quick Start Guide

Follow these steps to go from zero to a fully monitored VPS in under five minutes.

• 1

  Create Your Dashboard Account

  Visit /register and complete the sign-up form. Check your inbox for the verification email and click the confirmation link. Once verified, log in at /login.

• 2

  Add a VPS Node

  From the main dashboard, click the + Add VPS button. Fill in a friendly name for the server (e.g., WIN-PROD-01), the server's public IP address, the agent port (default: 8080), and an optional public IP override. The system generates a unique API key — save this, as you will need it during agent installation.

• 3

  Run the Agent Installer

  Log in to your target Windows Server via RDP. Open PowerShell as Administrator and run the one-line install command shown in your dashboard. The script automatically downloads the agent, creates the program files directory, and registers the agent as a Windows background service.

• 4

  Verify the Connection

  Return to the RCC Sentinel dashboard and select your newly added server from the server list. Within 30 seconds, the telemetry data should begin populating. A green "Online" indicator will appear next to the server name when the agent is responding successfully.

🖥️ Windows Agent Installation

The RCC Sentinel agent is a PowerShell script (monitor_agent.ps1) that runs as a persistent Windows service managed by NSSM (Non-Sucking Service Manager). The installation script handles all of this automatically.

Installer Command

Open PowerShell as Administrator on your target Windows Server and run the following command. This command is also available in your dashboard with your API key pre-filled:

iwr -useb https://monitor.readycheapcloud.com/deploy/install.ps1 | iex

The installer script performs these steps automatically:

1. Downloads monitor_agent.ps1 and nssm.exe from the central server.
2. Creates the installation directory at C:\Program Files\RCC-Monitor\.
3. Prompts you for your API key and server port (or reads them from environment variables if pre-set).
4. Writes a local config file (config.json) with your API key and port settings.
5. Registers the agent as a Windows service (RCC-Monitor) using NSSM, configured to start automatically on boot.
6. Starts the service immediately.

Configuration

The agent configuration file is located at C:\Program Files\RCC-Monitor\config.json. You can edit it manually if you need to change the API key or port after installation.

{
  "apiKey": "your-unique-api-key-here",
  "port": 8080,
  "serverName": "WIN-PROD-01"
}

After editing the config file, restart the RCC-Monitor service for changes to take effect:

Restart-Service -Name "RCC-Monitor"

Updating the Agent

When a new version of the agent script is available, an "Update Available" badge will appear next to your server name in the dashboard. You can trigger an update remotely by clicking the Update Agent button in the server controls panel — no RDP session required. The agent downloads the latest script, replaces the existing file, and restarts the service automatically.

Alternatively, you can manually update by running the installer command again on the target server. It will detect the existing installation and upgrade it in place.

Uninstalling the Agent

To completely remove the RCC Sentinel agent from a Windows Server, run the uninstaller script:

iwr -useb https://monitor.readycheapcloud.com/deploy/uninstall.ps1 | iex

This stops and removes the RCC-Monitor Windows service, removes the NSSM registration, and deletes the C:\Program Files\RCC-Monitor\ directory.

📊 Overview & Threat Map

The Overview sub-tab is the default view when you select a server. It displays four key metric cards at the top (CPU, RAM, Disk, Active Connections), followed by two panels: a live world threat map and a recent connections summary.

The threat map uses D3.js to plot a world map and draws animated connection arcs from the geo-located source IP of each active and recent RDP connection to your server's location. Connections from unusual countries are highlighted in amber or red to draw attention.

📈 Resource Telemetry

The Overview panel includes three large animated circular gauge dials for CPU, RAM, and Disk. Each gauge updates every 30 seconds when the agent poll cycle completes.

Configure per-server thresholds by clicking the Settings icon within the dashboard and navigating to Email & Alerts → Alerts.

🌐 Connections & Ports

The Connections & Ports panel shows a live table of all active network connections on the monitored server. Each row includes the remote IP address, resolved country and city, connection port, protocol, connection state, and the start timestamp.

A separate Auth Logins Audit panel below shows Windows Security Event Log entries for successful and failed login attempts, including the username, source IP, and event timestamp.

The Open Ports panel lists all ports currently in a LISTENING state on the server — useful for quickly auditing unexpected open services.

🛡️ Firewall & IPBan Integration

If your Windows Server runs IPBan (an open-source brute-force protection tool), RCC Sentinel can read its blocked-IP database and display it in a dedicated firewall panel within the Security & Firewall sub-tab.

Each blocked IP is cross-referenced against the AbuseIPDB threat intelligence database (if you have provided an AbuseIPDB API key in the settings panel). The enriched data includes:

• AbuseIPDB confidence score (0–100%)
• Abuse category tags (Brute Force, SSH Attack, Port Scan, Spam, Botnet, etc.)
• Date last reported to AbuseIPDB
• Total number of abuse reports on record
• Country of origin with flag

📋 Audit Trail

The Audit Trail sub-tab provides a chronological, searchable, and filterable log of every notable event — both automated (agent-detected) and manual (dashboard-initiated actions).

Automatically logged events include:

• Windows Security Event Log entries (logins, logouts, failed attempts)
• Windows System Event Log entries (service starts/stops, errors, warnings)
• Agent reconnection events (server came online/went offline)

Dashboard-initiated actions that are logged:

• Remote service start, stop, restart commands
• Remote process termination
• Remote server restart and shutdown commands
• VPS configuration changes (API key regeneration, threshold updates)
• Dashboard user logins and logouts

⚙️ Windows Services Manager

The Services Manager panel displays a full list of all Windows services on the monitored server, including their display name, internal service name, current state (Running, Stopped, Paused), and startup type (Automatic, Manual, Disabled).

You can start, stop, or restart any service remotely by clicking the action buttons on the right of each service row. The action is sent to the agent via an authenticated API call, and the result is reflected in the audit log.

🧩 Running Programs & Processes

The Processes panel shows all visible user-space applications and background processes currently running on the server. Each entry shows the process name, Process ID (PID), current CPU usage, and memory consumption in MB.

You can terminate any process remotely by clicking the Kill button. This sends a Stop-Process command via the agent API. Use this to stop runaway or suspicious processes without needing an RDP session.

🔄 Windows Update Manager

The Updates & Patches sub-tab queries your server's Windows Update history and pending update queue via the agent. It shows:

• All installed updates with their KB number, description, and installation date
• Pending updates not yet downloaded or installed
• Last reboot time and whether a reboot is currently pending

You can schedule a remote restart of the server from this panel to complete pending update installations. The scheduled restart is logged in the audit trail with the initiating user's account.

🖥️ Interactive Web RDP Gateway

RCC Sentinel includes a secure, clientless Web RDP Gateway powered by Apache Guacamole. This allows you to launch full, interactive remote desktop sessions for your monitored Windows VPS nodes directly inside a browser tab — without needing a desktop RDP client, VPN, or opening public RDP port 3389 to the world.

Session Provisioning

When you click the Live RDP button next to a Windows VPS node in your dashboard, the following sequence takes place:

• The dashboard backend validates your session and role permissions for the target server.
• The backend resolves the VPS node name to its secure VPN IP (e.g. 10.8.0.x) or private IP to keep traffic internal.
• The gateway dynamically provisions a temporary, authenticated Guacamole connection with auto-negotiated Network Level Authentication (NLA) security.
• A unique, tokenized client URL is generated and opened in a secure browser tab, giving you instant desktop access.

RDP Troubleshooting

If you encounter a "Connection Error" or black screen when launching a Web RDP session, check the following:

• RDP Services Enabled — Ensure Remote Desktop is enabled on the target Windows VPS (System Settings > Remote Desktop).
• NLA Credentials — Verify that you are entering the correct Windows Administrator credentials or have set them up in your node profile.
• Audio and Clipboard — Audio streaming requires browser permissions. Enable clipboard sharing in your browser prompt for text copy/paste features.

📧 SMTP Configuration

RCC Sentinel sends all email alerts and account emails (verification, password reset) through your own SMTP provider. This means you retain full control over email delivery and never depend on a third-party email service managed by us.

Configure SMTP credentials by navigating to Settings → Email & Alerts → SMTP & Delivery in the dashboard. The following fields are required:

After saving your SMTP settings, click Send Test Email to verify delivery is working correctly before enabling live alerts.

🔔 Alert Thresholds

Navigate to Settings → Email & Alerts → Alerts to configure per-metric alert thresholds. Each threshold triggers an email notification when the metric exceeds the set value for a sustained period.

The cooldown period prevents alert floods when a metric is oscillating around the threshold. An alert will not be re-sent until the cooldown period has elapsed since the last identical alert.

✉️ Email Templates

Navigate to Settings → Email & Alerts → Templates to view and customise the HTML email templates. RCC Sentinel ships with three built-in templates:

• System Alert — Used for all resource threshold and server offline alerts
• Account Verification — Sent to new users to confirm their email address
• Password Reset — Sent when a user requests a password reset link

Templates are editable HTML with placeholder variables in {{variable}} format. Available variables include {{serverName}}, {{publicIp}}, {{alertType}}, {{value}}, {{threshold}}, and {{timestamp}}.

🔑 API Key Management

Each VPS node registered in your dashboard is assigned a unique, randomly generated API key. This key is stored in the agent's config.json on the Windows Server and is sent as an X-API-Key HTTP header in every request from the agent to the central server.

The central server validates the key against the registered server configuration before processing any data. Requests with missing or invalid API keys return a 401 Unauthorized response and are logged.

You can regenerate the API key for any server from the dashboard at any time. After regenerating, you must update the config.json on the target Windows Server and restart the RCC-Monitor service, otherwise the agent will fail authentication until updated.

Firewall Port Requirements

Password Policy

Dashboard account passwords must be at least 8 characters long. We strongly recommend using a password manager to generate a strong, unique password for your RCC Sentinel account. Two-factor authentication (2FA) is on the roadmap for a future release.

🔧 Agent Not Reporting

If your server shows as Offline or the metric data is not updating, work through the following checklist:

1. Verify the service is running — Open services.msc on the Windows Server and check that RCC-Monitor is in a "Running" state. If it is stopped, start it manually and check the event log for error messages.
2. Check the firewall port — Ensure TCP port 8080 (or your configured port) is open inbound in both the Windows Firewall and your VPS provider's security group/firewall rules.
3. Verify the API key — Open C:\Program Files\RCC-Monitor\config.json and compare the apiKey value to the one shown in your dashboard for that server. They must match exactly.
4. Test connectivity manually — From the central monitor server (or any machine with the correct IP), try: curl -H "X-API-Key: your-key" http://VPS-IP:8080/metrics. If you get a JSON response, the agent is working and the issue is with the central server's polling configuration.
5. Check agent logs — Open Event Viewer on the Windows Server and look under Windows Logs → Application for events from source RCC-Monitor.

Email Not Sending

If you are not receiving alert or account emails:

1. Go to Settings → Email & Alerts → SMTP & Delivery and click Send Test Email. Check the result message shown in the dashboard.
2. Verify your SMTP credentials are correct. For Gmail, ensure you are using an App Password, not your regular password.
3. Check your spam/junk folder — the first emails from a new SMTP sender often end up there.
4. Ensure your SMTP host allows outbound connections on port 587 from your server. Some hosting providers block outbound SMTP — check with your hosting company.

Frequently Asked Questions

Q: Can I monitor Linux servers (not just Windows)?
A: The current agent is Windows-only (PowerShell). Linux agent support is planned for a future release.

Q: Is my metric data secure?
A: Yes. All data is stored in a secure, isolated database environment managed by the RCC Sentinel console, and all communications between the agent and the console are strictly encrypted and authenticated via API keys.

Q: How many VPS nodes can I monitor?
A: The number of monitored VPS nodes depends on your account plan. The Free tier includes monitoring for one active VPS node, while premium tiers support larger fleets.

Q: Can I change the polling interval from 30 seconds?
A: The 30-second polling interval is optimized for real-time alerting and minimal resource usage. Custom polling intervals are available on enterprise tiers.

Q: Is the dashboard data encrypted in transit?
A: Yes. The dashboard is fully served over HTTPS. All API calls, authentication requests, and RDP tunnel traffic are completely encrypted in transit.

🔌 API Reference

The RCC Sentinel central server exposes a REST API for metric collection and dashboard operations. All dashboard API routes require a valid session cookie (obtained by logging in). All agent-facing routes require a valid X-API-Key header.

Authentication Headers

# Dashboard API (requires login session)
Cookie: connect.sid=your-session-id

# Agent-facing API (used by the Windows agent)
X-API-Key: your-server-api-key

Endpoints