LinuxLens

Linux estate intelligence

See your Linux risk before it becomes an incident.

LinuxLens is a vendor-neutral assessment of lifecycle, patching, security exposure, and operational constraint. It answers which systems are at risk, why, and what is the most practical fix — not a CVE list, and not a product pitch.

Run on your server See the product

Open source · Read-only collector · Offline mode for regulated estates · Deterministic assessment

Open source

Run LinuxLens on your server.

Install the CLI, collect facts, and get a deterministic risk assessment. Nothing is uploaded. No packages, kernels, or services are changed.

1. Install

curl -fsSL https://linuxlens.suherman.net/install.sh | bash
source ~/.linuxlens_env

Or clone the GitHub repository and install the CLI from ./cli.

2. Assess this host

linuxlens assess localhost

Collects inventory and prints lifecycle, patch posture, LinuxLens risk (0–100), and capability-first remediation options.

3. Offline / regulated

linuxlens collect --archive ./linuxlens-assessment.tar.gz
# copy the archive out, then:
linuxlens assess --from-archive ./linuxlens-assessment.tar.gz

Use when hosts must not reach the Internet. The archive contains structured evidence only.

Never collected

  • Passwords and private keys
  • API tokens and secrets
  • Database contents and documents
  • User home-directory data

Many servers

# on each host (Ansible / SSH)
linuxlens collect --archive host-$(hostname).tar.gz

# on your workstation
linuxlens assess --from-archive ./host-prod-db-01.tar.gz \
  --criticality critical \
  --maintenance-window quarterly \
  --workload postgresql

View on GitHub Full getting-started guide install.sh

Built for platform engineers, SREs, infrastructure leaders, CISOs, consultants, and MSPs.

  • Banks & regulated estates
  • Mixed RHEL / Ubuntu / SUSE
  • Consultants who cannot upload

The gap

Scanners count CVEs. LinuxLens explains the estate.

Vulnerability tools answer which CVEs exist. Vendor consoles answer support status for one family. LinuxLens answers the question operators and executives actually ask.

Typical output

  • CVSS-ranked vulnerability list
  • One vendor’s support matrix
  • Live-patch product eligibility
  • A consulting spreadsheet that ages immediately

LinuxLens output

  • Composite risk with lifecycle, patch lag, and reboot constraint
  • Vendor-neutral mixed-estate view
  • Required capability, then optional providers
  • Repeatable, evidence-backed assessment and reports

Overview

Linux estate

284 servers

149 Healthy
53 Watch
49 High
33 Critical

Immediate attention

  • 33 critical systems
  • 18 end-of-life systems
  • 24 systems cannot easily tolerate reboot-based patching
  • 12 operating systems reach lifecycle milestones within 180 days

How it works

Facts in. Decisions out. No silent vendor default.

  1. 01

    Collect

    A read-only collector gathers host, OS, kernel, package, update, and operational metadata. Passwords, keys, and customer data stay out.

  2. 02

    Assess

    A deterministic engine scores lifecycle, patch lag, exposure, and operational constraint against published rules — not an LLM judgement.

  3. 03

    Recommend capability

    Patch, live patch, upgrade, migrate, extended support, compensate, or accept risk. The capability comes first.

  4. 04

    Map providers

    Only then: compatible products. “Live kernel patching is recommended.” Then, optionally, who can fulfil it.

Connected

Hosts → collector → HTTPS → LinuxLens API. Best for SaaS estates.

Offline

Collector writes linuxlens-assessment.tar.gz. Manual import. Nothing needs outbound Internet.

Relay

Hundreds or thousands of servers. Only the relay needs outbound connectivity.

LinuxLens risk

A score executives and engineers can both defend.

Raw CVSS is not estate risk. LinuxLens uses an explicit 0–100 model. Every Critical or High judgement cites collector evidence or declared business context.

Vulnerability exposure
30%
Lifecycle exposure
25%
Patch lag
15%
Operational constraints
15%
External exposure
10%
Business criticality
5%
  1. 0–19 Healthy
  2. 20–39 Watch
  3. 40–59 Elevated
  4. 60–79 High
  5. 80–100 Critical

prod-payment-db-01

RHEL 7.9 · PostgreSQL · quarterly window

91 Critical
  • Operating system outside standard lifecycle
  • 17 security updates outstanding
  • Kernel security exposure detected
  • 487-day uptime
  • Production-critical payments database
  • Reboot would require a payment-service outage

Primary recommendation

Apply non-disruptive mitigation immediately, then schedule operating system migration as the long-term remediation.

  • Live patch — low impact, no downtime, immediate risk reduction
  • Extended support — runway while migration is planned
  • Migrate / upgrade — durable fix, downtime required

Compatible providers are listed after the capability — never instead of it.

Customer journey

Start with a snapshot. Grow into continuous posture.

  1. 1. Linux Risk Snapshot

    Run linuxlens collect. Get band counts and immediate findings in hours, not a six-week project.

  2. 2. Deep Assessment

    Add criticality, windows, exposure, and regulatory context. Leave with a roadmap and investment plan.

  3. 3. Remediation

    Act on capabilities. Provider products appear only as fulfilment options.

  4. 4. Continuous LinuxLens

    Scheduled collection, drift, reassessment, alerts, and tracking. From engagement to platform.

Editions

From a one-off assessment to a partner portfolio.

LinuxLens Snapshot

One-off assessment for a small-to-medium estate. Rapid risk snapshot, executive summary, technical findings. Connected or offline import.

linuxlens collect · linuxlens assess

Principles

Independence is the product.

Vendor-neutral

TuxCare, Canonical, Red Hat, and SUSE can fulfil a capability. None of them own the score.

Capability-first

We never lead with “buy KernelCare.” We lead with live kernel patching, then who can deliver it.

Read-only

The collector does not patch, enrol, or change services. Safe to run on production hosts.

Deterministic

AI may explain a Critical host. It does not decide the host is Critical. Every answer traces to evidence.

Start

Request a Linux Risk Snapshot

Tell us about the estate. We will follow up with a low-friction snapshot path — including offline collection when nothing may leave the building.