Octotor — Settings

License →

Instance

Instance Name

Instance ID

Default Job Timeout (seconds)

Max Job Output (MB)

When a job's stdout exceeds this size, output is truncated with a marker. Job continues to completion. Default 10 MB. Range 1–1024 MB.

System Timezone

All scheduled tasks fire in this timezone. Defaults to your browser's timezone on first save. Operators in different regions can override.

Guided Tours button

Shows a Tour button on every page that lists the guided tours for that page. Switch it off to hide the button. The Tours menu in the top bar stays either way.

Default Customer for New Assets

Assets discovered by collectors or AD sync are assigned to this customer when no specific customer is set.

✓ Saved

Customer

Customer Name

AD Domain Name

Microsoft 365 Tenant

Asset Naming Scheme

Active Directory Sync (LDAP)

Domain Controller

LDAP Port

Use LDAPS (recommended)

Base DN

OU Scope (optional)

Sync Object Types

Users Computers Groups Printers

· ·

✓ Saved

Customers

Manage the list of customers whose assets are managed by this Octotor instance. Each asset must be assigned to a customer. Users can be restricted to specific customers.

Name	DNS Domain	DNS IP	Description	Assets

No customers defined yet. Add a customer to start assigning assets.

Users & Access

Username	Role	Groups	Customers	Active	Last Login
			All No access

My Two-Factor Authentication

TOTP is not enabled for your account.

TOTP is enabled for your account.

Monitoring

Enable background auto-ping

When enabled, the server automatically pings all monitored assets at the configured interval.

Auto-Ping Interval (seconds)

Live Monitor Refresh Interval (seconds) Used when Live Monitor is open on the Assets page.

Mark asset as Unknown after (seconds)

How old an asset's last successful check may be before its status displays as Unknown on the Assets and Live Monitor pages. Leave 0 for automatic (2× the ping interval). Increase this if healthy assets briefly flip to Unknown because a full check sweep takes longer than the automatic window. Display-only — alerting is not affected.

Ping Configuration

Tune ping behavior for LAN and WAN (VPN/Tailscale) environments.

Batch Size Assets pinged concurrently per batch (default: 10). Lower for WAN/VPN.

Timeout (seconds) Seconds to wait per ping before marking offline (default: 3).

Packet Count ICMP packets per ping (default: 3). Higher = more reliable but slower.

TTL Time-to-live for ICMP packets (0 = system default). Set lower to limit to local network.

TCP Monitoring

Check SSH, RDP, and WinRM port availability on computer assets. Runs independently from ICMP ping.

TCP Monitoring

Interval (seconds) Time between check cycles (default: 900 = 15 min)

Timeout (seconds) Per-port connection timeout

Batch Size Assets checked concurrently per batch

Skip if ping fails Skip TCP checks on assets that are offline (ICMP)

Protocols

Identity Verification

Enable or disable each verification component independently. All off = classic behavior (no identity checks).

DNS Resolution

Resolve hostname via DNS before ping

SSH Identity Gate

Probe hostname before job execution

WinRM Identity Gate

Probe hostname via WinRM before job

Require Successful Probe

Abort if probe fails (requires gate)

Default Gate: Linux

Preferred identity check for Linux

Default Gate: Windows

Preferred identity check for Windows

Collector Identity Check

Compare hostname after script execution

Mismatch Behavior

Action when a mismatch is found

Validity TTL (minutes)

Score expiry. 0 = never. Default: 60

Verification History Limit (per asset) Max verification events kept per asset. Default: 1000.

✓ Saved

Management Protocols

Configure remote execution protocols. Disabled protocols are hidden from all UI menus and the worker falls back to SSH.

Protocol Status

SSH

WinRM

Execution Defaults

Default protocol used when connecting to assets by OS family

Windows

Linux

Mac

SSH Configuration

Default Port

Per-asset override via SSH Port attribute

Timeout (seconds)

WinRM Configuration

Default Port

Timeout (seconds)

Auth Method

Kerberos and Certificate: future

✓ Saved

SNMP Collector

Connection and tuning for the SNMP switch collector. Poll cadence is per-task — schedule an SNMP Walk task in the Scheduler to control when and how often each switch is polled.

Enable SNMP collector (master switch)

When off, no switch is ever polled and the collector makes no outbound SNMP.

Default SNMP port

Default UDP port for new devices (per-device overrides).

Response timeout (s)

Per-request (per-PDU) SNMP timeout.

Walk deadline (s)

Max time for one full table walk.

Per-device timeout (s)

Max time budget per switch per cycle.

Discovery & events

Stability polls

Consecutive polls before an unknown MAC is queued to discovery.

Event dedup window (h)

Per-(MAC,switch) port-change event dedup.

Discovery cap / poll

Events cap / poll

MAC-table retention (days)

Min port speed (Mbps)

Ports below this feed the Ports Below Speed Floor alert attribute (e.g. 1000 = alert on sub-gigabit links).

Uplink auto-threshold (MACs)

A port with more learned MACs than this is auto-treated as an uplink/trunk — its devices are shown as transit, not mapped to it (0 = off). Mark specific uplink ports per-switch on the asset's SNMP Monitoring card.

✓ Saved

Monitored switches

SNMP monitoring is now configured on each switch asset. Open a switch on the Assets page, link its SNMP credential on the Credentials tab, then enable monitoring and choose the MAC/ARP roles + port on the Overview SNMP Monitoring card. Schedule polling with an SNMP Walk task in the Scheduler.

Backup Collector

The backup collector reads the job history of a Veeam Backup & Replication server (script windows/veeam-vbr-collect.ps1, scheduled as a task that targets computers whose Veeam Backup Server attribute filter equals true) and writes the result onto the protected computers and the backup server. It only reads from Veeam. Help ▸ Backup Collector has the full setup steps.

Switch on threshold alerts for the computers the collector finds

Yes: every time the collector lands data, each computer it matched and the backup server itself get the Threshold alert switch (Overview ▸ Alerts card) turned on, so the seeded backup rules (failed, warning, overdue) can fire for them. Each switch-on is written to the audit trail. No: the collector leaves the per-asset alert switches as they are; you enable them yourself on each asset.

Saved

There is no schedule to set here: the collector runs as a scheduled task (Scheduler page), and a backup counts as overdue when Veeam's own job schedule says a run is late. The rows shown on the Backup jobs tab are deleted after the number of days set in Maintenance ▸ Backup job history (days) (default 90).

Alerts

Notification Destinations

Used by the legacy email/Telegram channel. Per-rule notification channels are configured in the Alert Center page.

Alert Email(s)

Telegram Chat ID

Telegram bot token and SMTP credentials are set in the .env file on the server.

Alert Center

Operational controls for the Alert Center engine (oct-alert-worker). Per-asset toggles live on the asset edit modal; per-rule config is in the (future) Rules editor.

Alert Center Master

When disabled, oct-alert-worker ignores all NOTIFY events (rules still visible; fires are logged as 'alert_center_disabled' in action_log)

Storm Cap (per rule / min)

Beyond this rate, additional events are merged into the first alert of the minute (dedupe_count + storm_suppressed)

Retention (days)

Resolved alerts older than this are pruned by scheduled maintenance

✓ Saved

Attribute Definitions

Define which fields are collected and displayed for each asset type. Auto-approve means collector data is applied immediately, including removals (when the source reports a value is gone — e.g. an M365 license unassigned — the attribute is cleared); otherwise both updates and removals go to the pending queue for review.

Auto Attribute Updates

When enabled, collector scripts automatically create attribute updates (pending or auto-approved). When disabled, collectors still run and output is saved to job history, but no attribute records are created. Admin must update attributes manually. Toggling this saves immediately — no Save button needed.

Auto-approve discovered identities

When enabled, account collectors (e.g. AD user discovery) create new account and person assets directly. When disabled (default), newly discovered identities wait in the Discovery queue on the Assets page for per-item approve/reject. Already-known accounts always refresh in place.

Auto-map users to computers

When enabled (default), Octotor automatically links a person to the computer they use, based on the machine's detected primary user (from the collector). It also corrects a wrong existing owner as each machine is re-collected — self-cleaning. Set a person's primary user by hand and lock it to override. When disabled, the Assets → "Suggest users" panel can still be used manually.

Auto-link when the user accounts for at least % of that machine's logins within the last 14 days.

Default 50% (a majority). Below this, the machine is left for the manual "Suggest users" panel instead of being auto-linked. A locked primary user always wins regardless.

Key	Label	Type	Asset Type	Auto-approve

No attribute definitions found.

Access Credentials

Centrally managed credentials. Link them to assets from the asset detail view.

Account Providers

The account types operators can attach to user assets. Each provider's attributes are defined in Settings ▸ Attributes (its asset-type selector includes every provider) and shown here read-only.

Key

lowercase, digits, _ · starts with a letter

Label

Icon

PROVIDER	KEY	FIELDS	ACCOUNTS	STATE

Display name

Icon

Attributes

read-only · defined in Settings ▸ Attributes (asset type = )

KEY	LABEL	TYPE	OPTIONS	AUTO

No attributes defined for this provider yet — add them in Settings ▸ Attributes.

Collected by

read-only · set in Toolkit ▸ script ▸ Collects

No collector scripts target this provider yet.

M365 Connectors

Connect Microsoft 365 / Entra tenants for account & device collection — one connector per customer. Octotor generates the certificate; you upload the public half to your Entra app registration. Step-by-step guide: Help ▸ M365 Connectors.

Collector master switch

OFF = the collector makes no outbound connections at all; connectors stay stored but inert. Certificate generation works either way (local only).

Saved

Microsoft endpoints

Graph host

Saved

Only change these if Microsoft ever renames its endpoints. They are the collector's outbound allow-list — every sync/test call is pinned to exactly these two hosts. Bare hostname only (no https://, no path); leave empty for the built-in defaults. Changes apply on the next sync/test, no restart needed.

Customer

Tenant ID

Application (client) ID

From the Entra app registration overview page.

CUSTOMER	TENANT	THUMBPRINT	CERT	TEST	STATE

No connectors yet. Add one, download its certificate, upload it to your Entra app, then run Test.

Hover a row to see its last keygen/test detail. Test requires the master switch ON.

Jump Hosts

SSH bastions the worker tunnels through to reach an asset it can't connect to directly (segmented VLANs, bastion-only appliances). Attach one to an asset from the asset's Overview. Each is linked to a customer and an SSH credential.

Name *

Host (IP or hostname) *

SSH port

Customer *

SSH credential

Description

Enabled

NAME	HOST	CUSTOMER	CREDENTIAL	ASSETS	STATE

No jump hosts yet. Add one, then attach it to an asset from the asset's Overview panel.

Groups & Permissions

How permissions work:

• Admins have full access to everything — groups have no effect on them.

• Viewers have fixed read-only access (Dashboard, Assets, Logs) — they cannot be added to groups.

• Operators start with full access to all scripts and protocols. Create custom groups to narrow their access to specific pages, scripts, and protocols.

• Once an operator is added to any custom group, they only see the scripts and protocols granted by that group — not everything.

• To change a user's role (viewer/operator/admin), edit the user under Users & Access.

No groups found.

AI Configuration

AI Status

LLM Model:

LiteLLM:

Ollama:

Model in RAM:

Model is kept loaded in RAM permanently (OLLAMA_KEEP_ALIVE=-1). Use Unload to free RAM when AI is not needed.

Goose Engine

Cloud AI Access

Allow Goose Chat to use a cloud AI model (e.g., Claude) instead of the local Ollama model. Cloud models provide better reasoning for complex tasks but require internet access and an API key. When disabled, all AI features use the local Ollama model only.

Provider:

Anthropic API Key

Stored encrypted with MASTER_KEY in the database (AES-256-GCM, same scheme as credentials). Setting + deleting requires the master action password.

AI Features

Script Validation

AI validates scripts before saving in Toolkit

Requires AI Validation in your license.

AI Investigation

Natural language queries on the Investigate page

Log AI Conversations

Record AI queries and responses in the audit log (visible under Logs)

Auto-load Model on Startup

Load the AI model into RAM when Octotor starts (eliminates cold-start delay)

AI Engine per Activity

Choose Local (Ollama, free, private, on-device) or Cloud (Claude, faster, better reasoning, requires internet + API key). Other activities (collector parse, event summaries, search filters) always use Local.

Goose Chat agent conversations, tool use, scheduled recipes

Script Validation security check before saving scripts in Toolkit

Protocol Auto-Validation

Planned for future release

Planned

Goose Agent

AI agent for automated IT operations

Confirmation Mode

Controls whether Goose actions need admin approval

Max Tool Result Size

Maximum data (KB) sent to the LLM per tool call. Larger = more context but slower. Default: 200KB.

Security

Verify Identity

This section requires verification to access.

Action Password

TOTP Code

Action Passwords

Action passwords are separate from your login password. They protect sensitive toolkit and scheduler operations even if your session is compromised.

Master Action Password

Passwords do not match ⚠ Not configured — sensitive operations are unprotected

✓ Configured

Passwords do not match

Recovery Key — save this now, it will not be shown again

This key bypasses rate limiting and lockout. Use it if you forget your master action password or get locked out. Store it in a password manager or print it.

Require TOTP with every action prompt

Toggling this saves immediately — no Save button needed. Requires at least one admin with TOTP enrolled.

Per-Action Overrides

Action	Password
	✓

Script Signing

Signed scripts are cryptographically verified to ensure they haven't been tampered with since creation.

Require signed scripts for execution

Coming soon

Custom Signing Key (Ed25519 public key)

API Tokens

API tokens allow programmatic access to Octotor. Use them for integrations, agents (Goose), and automation.

Requires API Tokens in your license

Name	Owner	Scopes	Expires	Last Used	Created

No API tokens created yet.

Network Address Translation (NetMap)

Map customer LAN subnets to Tailscale-routed subnets when customers have overlapping IP ranges. Translation is applied at runtime — stored asset IPs remain the real LAN addresses.

Customer

Original CIDR

→

Mapped CIDR

Notes

#	Customer	Original Network		Mapped Network	Notes
			→

Software Updates

Status

Current version Latest known Last check

An update is available. Install stays CLI-driven: run the octotor-upgrade.sh one-liner on the host — see Help ▸ Software Updates for the exact command.

You are on the latest published version for this major.

A newer major version exists — contact licensing about upgrade options.

Check Settings

Once a day Octotor fetches the published version list to learn whether a newer release exists. Nothing about this installation is sent — it is a plain read of a static file. Turning it off stops the daily check; the Check now button always works.

Daily update check

Checks run daily in the background

Version list URL

The published latest.json on the deployment host

✓ Saved

Support

Diagnostic Bundle

Generates one downloadable archive of this installation's diagnostic state for troubleshooting with support. Nothing is sent anywhere — the file downloads to your computer and you send it to support yourself, by email or your own file share. There is no upload feature.

Included

Version, migration level, service heartbeats
License state summary (tier, expiry — no key material)
Recent failed jobs (metadata only) + alert counts
Error entries from the action log
Settings with secret-looking values masked

Never included

Credentials or credential data
Encryption keys, JWT secrets, API tokens
.env contents
Job outputs or commands (can embed secrets)

Database Maintenance

Data Retention

Configure how long each type of data is kept. Applied by scheduled maintenance or manual prune.

Event Log (days)

Action log entries (login, config, identity alerts)

Job History (days)

Completed/failed jobs + output text

Identity History (days)

DNS/SSH/collector verification records

AI Conversations (days)

Goose chat history and recipe logs

Attribute History (days)

Attribute change log (old→new values)

M365 Sign-ins (days)

M365 sign-in events collected by the connector

Backup job history (days)

Veeam job sessions shown in the Backup jobs tab (collected by the backup collector)

Scheduled Maintenance

Automatically prune old data and vacuum the database on a schedule. Database backups run separately via host cron (daily at 2:00 AM) — see Backup Status below.

Scheduled Maintenance

Run maintenance on the schedule below

Schedule (cron)

Examples: 0 2 * * * daily 2AM · 0 3 * * 0 Sunday 3AM · 0 */6 * * * every 6h

Backup Retention (days)

Delete backup files older than N days

Backup schedule: Database backups run automatically on the host via cron (daily at 2:00 AM). Backup files are kept for 7 days. See "Backup Files" below to view and download. To change the schedule, edit the host crontab: crontab -e

✓ Saved

Backup & Optimization

Create database backups, optimize performance, or reclaim disk space.

Backup Status

Backups run via host cron (daily at 2 AM).

Click Check to load status.

Optimize

Runs VACUUM ANALYZE — reclaims space from deleted rows and updates query planner statistics. Safe to run anytime, no locks, no downtime.

Deep Optimize

Runs VACUUM FULL — rewrites all tables for maximum disk reclaim. Locks all tables during operation. Users may see errors.

Manual Data Cleanup

Manually delete old records from a specific table. Select the table, enter how many days of data to keep, click Preview to see how many rows will be deleted, then confirm.

Table

Keep last N days

No records older than days

Deleted data cannot be recovered. Create a backup first if needed.

Database State

#	Table	Rows	Size	Dead Tuples	Last Vacuum

Click "Refresh All" to load database statistics.

Backup Files

Backup files contain encrypted credentials and password hashes. Handle with care.

#	Filename	Size	Created
				Download

No backup files found. Backups run daily at 2 AM via host cron.

Recent Activity

#	Time	Action	Operator	Detail	Status

No maintenance activity yet.

System

System-wide policies and limits.

CSV Import Limit

Maximum number of assets per CSV import

Allow Operators to Import CSV

When disabled, only admins can use CSV import. Operators can still add assets one by one.

Guided Tours Button

Shows a Tour button in the header of every page, listing that page's guided tours. Tours open in the public Octotor demo (demo.octotor.com) in a new tab, using sample data — nothing runs on this install. The Tours menu in the top bar is always shown.

Dashboard Sections

System Status Monitor

Show system health, container stats, and monitoring load on the Dashboard (admin only)

Auto-Refresh Interval

How often to poll system health (seconds)

Settings

Instance

Customer

Active Directory Sync (LDAP)

Customers

Users & Access

My Two-Factor Authentication

Monitoring

Identity Verification

Management Protocols

SNMP Collector

Discovery & events

Monitored switches

Backup Collector

Alerts

Notification Destinations

Alert Center

Attribute Definitions

Access Credentials

Account Providers

M365 Connectors

Jump Hosts

Groups & Permissions

AI Configuration

AI Status

Cloud AI Access

AI Features

Security

Verify Identity

Action Passwords

Per-Action Overrides

Script Signing

API Tokens

Network Address Translation (NetMap)

Software Updates

Status

Check Settings

Support

Diagnostic Bundle

Database Maintenance

Data Retention

Scheduled Maintenance

Backup & Optimization

Manual Data Cleanup

Database State

Backup Files

Recent Activity

System

Dashboard Sections

Create API Token

Token Created

Permissions —

Page Access

Script Access

Protocol Access

Credential Access

Members —

Add to Group

Effective Permissions —

Customers

Pages

Scripts

Credentials

Groups

AI Access

Set Up Google Authenticator

Backup Codes