Overview

Proxmox VE Inspector (Beta)

Proxmox VE is an open-source virtualization platform for KVM virtual machines and LXC containers, and a common VMware ESXi replacement for MSP Customers. The Proxmox VE Inspector (Beta) reads a Proxmox cluster or standalone host through its REST API with a read-only API token. It documents the cluster, its nodes, and every virtual machine and container, including snapshots, backup coverage, storage, users, and permissions. Each Proxmox node becomes its own Child Inspector, so you can track change and risk per host and per cluster across every Customer, with no software installed on the hypervisor.

What you can monitor

The Proxmox VE Inspector collects cluster, guest, and host data, including:

• Cluster health: quorum, node membership, and offline nodes
• Every virtual machine and LXC container with its host, status, sizing, OS type, start-at-boot, HA state, pool, tags, snapshots, and locks
• Backup coverage: backup jobs and schedules, guests in no backup job, and every backup task from the last 7 days with its result
• Storage capacity, high availability resources, replication jobs, and resource pools
• Users, API tokens, role assignments, authentication realms, and second-factor enrollment
• Per node: Proxmox VE and kernel version, end-of-life status, subscription, update repositories, certificates, network interfaces, physical disk health, root filesystem usage, and core service state

How it works

You add one Parent Inspector per Customer cluster (or standalone Proxmox host), pointed at any node in the cluster. The Parent reports the cluster as a whole and auto-discovers one Child Inspector per Proxmox node, which reports that physical host. One read-only API token covers the whole cluster, and the Inspector never changes anything on the host.

Benefits

• Keep the visibility you had on VMware ESXi after migrating a Customer to Proxmox VE: a documented inventory of every VM and container, with change history.
• Prove backup coverage: find guests outside every backup job, failed backup tasks, and clusters with no successful backup in 7 days.
• Know as soon as a node goes offline or a cluster loses quorum.
• Catch capacity problems early: storage below 20% or 10% free and host root filesystems above 90%.
• Stay ahead of lifecycle risk: end-of-life Proxmox VE releases, lapsing subscriptions, expiring certificates, and the enterprise update repository enabled without an active subscription (updates silently fail).
• Review access: track users, Administrator role assignments, and API tokens that never expire or carry full user privileges.

The Inspector ships with 24 alert rules, listed in the Proxmox VE Inspector Summary.

Inspector Setup Preparation

Step 1: Create the API Token in Proxmox VE

1. Sign in to the Proxmox VE web interface and select Datacenter.
2. Go to Permissions > Users and select Add. Create a user such as liongard with Realm Proxmox VE authentication server, and select Add.
3. Go to Permissions > API Tokens and select Add. Choose User liongard@pve, enter a Token ID such as inspector, leave Privilege Separation checked, and select Add.
4. Copy the credentials. The Token Secret window shows the Token ID (for example, liongard@pve!inspector) and the Secret. Proxmox displays the secret only once.
5. Go to Permissions and select Add > API Token Permission. Set Path to /, API Token to liongard@pve!inspector, Role to PVEAuditor, keep Propagate checked, and select Add.
6. Select Add > User Permission and grant the same Role PVEAuditor on Path / to the user liongard@pve.

Alternatively, run these commands from a node shell:

pveum user add liongard@pve
pveum user token add liongard@pve inspector --privsep 1
pveum acl modify / --tokens 'liongard@pve!inspector' --roles PVEAuditor
pveum acl modify / --users liongard@pve --roles PVEAuditor

Inspector Setup:

Step 2: Configure the Proxmox VE Inspector in Liongard

1. Log in to the Liongard platform.
2. In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the Proxmox VE Inspector > Select Add System.

Each Customer cluster (or standalone Proxmox host) gets one Parent Inspector in that Customer's Environment. The Parent then auto-discovers a Child Inspector for each Proxmox node.

Fill in the following information:

• Type of Inspector: Parent
• Environment: Select the Customer's Environment
• Friendly Name: Suggested Naming: [Customer Name] Proxmox VE Parent
• Agent: Select a Self-Managed Agent on the Customer network
• Inspector Version: Latest
• Host: Hostname or IP address of any node in the cluster, or of the HTTPS proxy in front of it, without https:// (for example, 192.168.10.20 or pve1.example.local). Any node reports the whole cluster.
• Port: Leave blank for the default 8006. Use 443 when the host is published through a reverse proxy.
• API Token ID: The full Token ID, in the form user@realm!tokenname
• API Token Secret: The Secret shown when you created the token
• Verify TLS Certificate: Turn off unless the node has a certificate from a trusted certificate authority. Proxmox VE uses a self-signed certificate by default; traffic stays encrypted either way.
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule
• Select Save. The Inspector will now be triggered to run within the minute.

Step 3: Child Inspector Setup

After the first run of the Parent Inspector, each Proxmox node will be auto-discovered and surfaced in the Discovered Systems tab on the Inspectors > Proxmox VE page, already assigned to the Parent's Environment.

• Activate or Archive your Discovered Systems by ensuring they're mapped to the correct Environment > Check the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints (or Archive Launchpoints).
• Click Save.

Troubleshooting

• Proxmox VE rejected the API token: Use the full Token ID (user@realm!tokenname) and the matching Secret, and confirm the token hasn't expired or been removed under Datacenter > Permissions > API Tokens.
• The API token is missing a privilege: Grant PVEAuditor on / with Propagate to the API token itself (Add > API Token Permission). With Privilege Separation, a permission on the user alone isn't enough.
• Certificate errors: Turn off Verify TLS Certificate, or install a trusted certificate under Node > System > Certificates.
• Connection timeouts: Confirm the Agent can reach the node on port 8006 (or the configured port), and that the Proxmox ALLOW_FROM setting in /etc/default/pveproxy permits the Agent's address.
• The Inspector doesn't save: Enter the Host as a bare IP address or hostname, without https://.
• A node shows Online = false: That node is down or unreachable from the rest of the cluster. The node's Child Inspector reports this rather than failing.

Inspector FAQs