Linux Managed Services

What Linux managed services cover

Linux server management is the recurring operational work that keeps a fleet secure, current and fast: package and kernel patching, user and SSH key lifecycle, firewall and service hardening, log shipping, backup jobs and restore tests, filesystem and memory trend monitoring, and a change record for every one of them.

We manage Ubuntu LTS, Red Hat Enterprise Linux, Rocky, AlmaLinux, Debian and Amazon Linux, plus the platform layer that usually sits on top: NGINX, Apache, HAProxy, PostgreSQL, MySQL and MariaDB, Redis, Docker and containerd, PHP-FPM, Node.js and Java runtimes. Hosts can be physical, virtualised on VMware, Proxmox or KVM, or cloud instances on AWS, Azure and GCP.

Onboarding starts with a baseline of every host: kernel and package versions, listening ports, running services, sudoers, SSH configuration, backup coverage and monitoring coverage. Gaps become tickets with owners and dates.

Linux patch management

Monthly patch cycles for every managed host, with out-of-band windows for critical CVEs on the CISA Known Exploited Vulnerabilities list or vendor emergency advisories. Updates are staged where a staging tier exists, applied in agreed windows with Ansible, and verified by post-patch service checks before the ticket closes.

Kernel updates use Canonical Livepatch or kpatch where the subscription and kernel support it, so security fixes land without a reboot. Reboots that cannot be avoided are batched, announced and rolled through load-balanced groups one node at a time.

Each cycle produces a patch report: applied, deferred with reason, and outstanding exposure. Unattended-upgrades is configured for security-only updates on tiers where that is appropriate; everything else goes through the cycle.

Linux hardening to a written baseline

Every host is hardened against the CIS Benchmark for its distribution, adapted to the workload and enforced with Ansible so drift is corrected rather than reported. Controls include key-only SSH with MFA on bastions, no direct root login, nftables or firewalld default-deny, AppArmor or SELinux in enforcing mode, auditd rules shipped off-box, core dumps and unused filesystems disabled, and file integrity monitoring on system paths with AIDE or Wazuh.

Access follows least privilege: named accounts, sudo rules scoped to commands, quarterly access reviews and immediate key revocation when people leave. Shared root passwords and service accounts with interactive shells are removed during onboarding.

Compliance evidence is a by-product. Hardening reports, access reviews and audit logs map to ISO 27001, PCI DSS and SOC 2 controls; the certification and audit work itself is delivered by our sister firm PraxisQ Consulting.

Monitoring and 24/7 Linux support

Every managed host runs Zabbix agent 2 reporting into our NOC, with cloud hosts also feeding CloudWatch or Azure Monitor metrics. Standard triggers cover CPU steal and load, memory pressure and OOM kills, disk usage with forecast-based alerts, inode exhaustion, I/O wait, systemd unit failures, certificate expiry, backup age and reboot-required flags.

P1 incidents (host or critical service down) are acknowledged within 15 minutes, 24/7, by an engineer with shell access and a runbook. Lower-priority requests such as package installs, config changes and user management are handled in business hours for your region.

Every downtime incident gets a written root-cause note. If the fix is a change to the baseline or the monitoring, that change is made across the fleet, not just on the host that failed.

Backups, restore testing and recovery

We manage backup jobs with restic, Bacula, Veeam agents or native cloud snapshots, verify completion daily, and run a timed restore test per server class every quarter. Results go in the monthly report.

RPO and RTO are written down per host class. Where the current design cannot meet them you get a costed option to close the gap, not a discovery during an outage.

Performance tuning and capacity planning

Kernel parameters, filesystem mount options, I/O schedulers, database memory and connection pools, and web-server worker counts are tuned against Zabbix metrics, held for review, and reverted if they do not move the number they were meant to move. Every tuning change is captured in Ansible so it survives the next rebuild.

Monthly capacity reviews look at 90-day trends. You hear about the volume that will fill in six weeks now, with the cost of the fix, rather than when it does.

Configuration as code

Every managed host is described in Ansible and, for cloud instances, Terraform. A rebuilt server matches the one it replaced, a change is a reviewable diff, and the inventory is always current because it is the source of truth rather than a spreadsheet. You keep the repository; if we part ways, the estate remains fully documented.

Pricing and engagement

Linux managed services are priced per server per month, tiered by criticality. Production tiers include 24/7 P1 cover. Small estates start on a fixed monthly plan; larger fleets and MSPs get a per-node rate with a dedicated lead engineer. Onboarding takes one to two weeks. Contracts are monthly rolling after the first quarter.

We support estates in the UK, US, Australia, UAE, Singapore and India, with engineers on rotation across those time zones. For mixed estates, Windows Server management is delivered by the same team under the same reporting.