Runs one command or a list of them on a server and returns the exit code, stdout and stderr of each. Every command gets its own shell, so a variable set or a directory entered in one is gone in the next. Work measured in minutes should be detached rather than given a longer timeout: a detached call returns a job id at once and outlives this request. Reach for it last — files, logs, transfers, health and jobs each have a tool that batches the round trips and parses the answer.

Reads text files from a server, several of them in one call. A file too large or not text comes back as a named failure rather than a partial file, and one unreadable path costs the others nothing. Real binary should travel over the transport instead of the command channel, which has a size limit. To look for something inside logs, ssh_log_search greps on the server rather than shipping the file here.

Writes text files on a server, several in one call, each with its own permissions. Content lands under a temporary name and takes its place in one rename, so a half-written file never appears at the target, and an optional sha256 check confirms what arrived. A file is replaced whole; there is no append. For something that already exists on this machine, use ssh_upload.

Lists a directory on a server: every entry with its size, mode, owner and modification time. A glob narrows the answer, and a recursive walk that hits the output limit says so instead of returning a shortened list silently. To see what is inside a file, use ssh_file_read.

Reports the state of a detached job, with the last lines it wrote so you can see where it got to. lost = no exit code, but ssh_job_output still has the output.

Returns what a detached job has written so far, stdout and stderr together, from a byte offset you choose. The answer names the next offset, so reading again never overlaps or skips a line. For whether the job is still running, ssh_job_status answers in one line.

Lists the detached jobs on a machine with their state, for when an id was not kept, jobs started with sudo included. Ids and states only — for what a job printed, use ssh_job_output.

Stops a detached job. The signal reaches the whole process group, so anything the job started goes with it, and a job that already finished is reported as gone rather than refused. TERM is the default; KILL is for a job that ignored it.

Returns the last lines of one or more log files, whatever their size — nothing is shipped here to be trimmed locally. Globs are expanded by the server's find rather than a shell, so a name holding a space or a newline stays one path. To look for something instead of reading the end, use ssh_log_search.

Greps log files on the server and returns the matching lines with their paths, or the paths alone when line bodies are not wanted. An empty answer means no match, never a failed search: files that could not be read are listed apart. A time window first skips files untouched in it and then keeps only lines dated inside it, which is what lets a year of logs finish. For the tail of a file, ssh_log_tail is cheaper.

Reports how a machine is doing right now: cpu, memory, disk, containers, listening ports, services and recent errors, in one round trip. Whatever could not be measured comes back null and marked unavailable, never as a zero that reads like an idle machine. For how the machine is set up rather than how it is running, use ssh_audit_baseline.

Looks after the SSH connections, not the machines behind them: lists the configured profiles, tests one and names the state (ready, limited, no-route, rejected), reports pool statistics, closes a connection or reloads the profile file. Close and reload drop live connections; the other actions only read. Start here on a machine you have not used yet — test says whether anything else will work.

Copies a local file or directory to a server. Data lands under a temporary name and takes its place in one rename, verified by sha256 — a half-written file never appears at the target. A directory replaces the target whole, not file by file, and sudo stages in /tmp first, so the machine needs room for a second copy, and setting an owner needs it too. For text you can paste, ssh_file_write is cheaper; piping base64 through ssh_exec truncates silently.

Copies a file or directory from a server to this machine. Data lands under a temporary name and takes its place in one rename, and every file is checked by sha256 on both sides; a machine without sha256 answers 'unavailable', which means delivered, not broken. A root-owned copy stages in /tmp on the server, so it needs room there. To read a text file rather than keep it, ssh_file_read skips the disk.

Reports how a machine is set up: sshd, firewall, pending updates, failed services, docker, listening ports and disk, each section marked CRITICAL, WARNING or OK. Reads only, in one round trip instead of a dozen commands; without sudo the sshd section is read from the config file rather than from sshd itself. Use it on a machine you have not audited yet; for load and health at this moment, use ssh_snapshot.

Checks the TLS certificate a domain serves, with the handshake made from the server itself — so it sees what that machine sees, including hosts closed to the outside. Reports days left, whether the name matches a SAN, the issuer and whether renewal is configured — without sudo a missing renewal hook only means the config could not be read. A null field means the check could not run, not that the certificate is bad. Run it per domain, once ssh_audit_baseline has named the sites.

Finds what filled a disk. Reports free space per filesystem, the largest directories under each path given, and what docker, journald and package caches hold. Reads only, nothing is deleted. Use it after a disk alarm; for how full the disks are at all, ssh_snapshot answers in one line.

Reports one systemd unit: whether it is loaded, active and enabled, with the tail of its journal. A machine without systemd comes back as NOT CHECKED, never as a stopped service — that would read as an outage which is not there. Without sudo the journal is trimmed to what the profile user may see. For every failed unit at once, ssh_audit_baseline names them.