# Monitoring guide

Monitoring is split by host type:

- **Servers**: `roles/monitoring_server/` (includes `fail2ban`, sysstat tooling)
- **Desktops/workstations**: `roles/monitoring_desktop/` (desktop-oriented tooling)

## Run monitoring only

```bash
# Dry-run
make monitoring CHECK=true

# Apply
make monitoring
```

## Notes

- Desktop apps are installed only on the `desktop` group via `playbooks/workstations.yml`.
- If you need packet analysis tools, keep them opt-in (see `docs/reference/applications.md`).