Why manage servers with wiiiv
You've just taken over a new server. You need to track SSH login failure IPs, set up a firewall, diagnose performance bottlenecks, tune kernel parameters, and automate backups. Each task requires knowledge of journalctl, nftables, vmstat, sysctl, and crontab commands.
With wiiiv, just say "Analyze SSH login failure logs from the last 7 days." The AI builds a journalctl + awk pipeline, executes it on the server via SSH, and presents the attacking IPs sorted by frequency.
Connection Security
SSH passwords are used only within the session. With wiiiv's SSH host pre-registration feature, you can connect without entering a password in the conversation.
sudo Privilege Management
Tasks requiring admin privileges — firewall setup, kernel tuning, cron registration — are also handled through conversation. The sudo password is provided once at connection and reused within the session.
Dangerous Command Blocking
Destructive commands like rm -rf and dd if=/dev/zero are automatically detected by OsHazardGuard. They will not execute unless the user explicitly approves.
Target Server
This is the server we'll inspect in this guide. Provide the connection details, and everything after that is done through conversation.
Full Execution Flow — 13 Turns
You've just taken over a new server. From connection to security audit, performance diagnosis, automation, and hazardous command control — the entire onboarding inspection is performed through conversation.
Connect
Overview
Audit
Analysis
Setup
Profiling
Diagnosis
Forensics
Tuning
Automation
⚠ Blocked
⚠ Detected
| Item | Value |
|---|---|
| OS | Rocky Linux 9.5 (Blue Onyx) |
| Kernel Version | 5.14.0-503.40.1.el9_5.x86_64 |
| Uptime | up 3 weeks, 1 day, 16 hours, 15 minutes |
| CPU Cores | 4 |
| Total Memory | 3.6Gi |
| Used Memory | 776Mi |
| Available Memory | 2.8Gi |
| Total Swap | 3.2Gi |
| Used Swap | 10Mi |
Disk usage by partition:
| Filesystem | Type | Size | Used | Avail | Use% |
|---|---|---|---|---|---|
| /dev/mapper/rl-root | xfs | 28G | 11G | 18G | 39% |
| /dev/sda1 | xfs | 960M | 316M | 645M | 33% |
| tmpfs | tmpfs | 732M | 68M | 665M | 10% |
| /dev/mapper/vg_test-lv_test | ext4 | 455M | 14K | 426M | 1% |
| Attacking IP | Count |
|---|---|
172.30.1.254 | 8 |
| Time | Count |
|---|---|
| 05:00 | 8 |
Summary: 1 attacking IP — 172.30.1.254. All failed attempts are concentrated at 05:00 AM.
| Protocol | Local Address:Port | Process | Exposure | Assessment |
|---|---|---|---|---|
| udp | 127.0.0.1:323 | chronyd | Local only | Normal |
| tcp | 0.0.0.0:22 | sshd | All IPv4 | Normal/Critical |
| tcp | *:3306 | mariadb | All interfaces | Caution |
Assessment: MariaDB (3306) is bound to all interfaces, which poses a relatively high risk and requires attention.
Generated and executed the firewall script:
Verification failed: sudo nft list ruleset output was empty — unable to confirm the applied rules.
nft list output was empty during verification. It does not disguise an unverified result as "success."
vmstat 5 3 results:
| r | b | swpd | free | buff | cache | si | so | id | wa |
|---|---|---|---|---|---|---|---|---|---|
| 1 | 0 | 11172 | 972612 | 680 | 2335860 | 0 | 0 | 100 | 0 |
| 0 | 0 | 11172 | 977512 | 680 | 2335884 | 0 | 0 | 100 | 0 |
| 0 | 0 | 11172 | 978644 | 680 | 2335892 | 0 | 0 | 100 | 0 |
iostat -xz 5 3 key devices:
| Device | r/s | w/s | rkB/s | wkB/s | r_await | w_await |
|---|---|---|---|---|---|---|
| sda | 0.86 | 0.62 | 36.13 | 38.95 | 0.34 | 3.42 |
| dm-0 | 0.86 | 0.65 | 36.06 | 38.92 | 0.33 | 2.10 |
Bottleneck assessment:
Nameservers:
| # | Nameserver |
|---|---|
| 1 | 8.8.8.8 |
| 2 | 168.126.63.1 |
| 3 | 168.126.63.2 |
Forward/Reverse lookups:
| Domain | Lookup Result | Response Time |
|---|---|---|
google.com | 2404:6800:400b:c00c::71 + 3 more | 26 ms |
naver.com | 223.130.200.219 + 3 more | 33 ms |
8.8.8.8 (reverse) | dns.google. | — |
traceroute google.com — 18 hops:
| Hop | Via |
|---|---|
| 1 | _gateway (10.10.10.1) |
| 2 | 172.30.1.254 |
| 3 | 220.77.78.1 |
| 4–7 | 112.174 → 112.190 → 142.250 → 72.14 ... |
| 13–17 | * * * (no response) |
| 18 | ri-in-f139.1e100.net (142.251.23.139) |
| Frequency | Pattern |
|---|---|
| 276 | nginx-check.service: Failed with result 'exit-code' |
| 276 | nginx-check.service: Failed to execute ... Exec format error |
| 1 | sshd: error: kex_exchange_identification: read: Connection reset |
Analysis:
The most significant recurring failure is nginx-check.service. The root cause is an Exec format error when running /usr/local/bin/nginx-check.sh, likely due to a missing shebang or file format issue.
vm.swappiness = 10 to /etc/sysctl.d/99-tuning.conf and applied.
| Parameter | Value |
|---|---|
| net.ipv4.tcp_rmem | 4096 131072 6291456 |
| net.ipv4.tcp_wmem | 4096 16384 4194304 |
| fs.file-max | 9223372036854775807 |
| vm.swappiness | 10 Applied |
/etc/sysctl.d/ and running sysctl --system requires admin privileges. sudo is automatically handled using the password provided in T0.
| Item | Value |
|---|---|
| Script Path | /usr/local/bin/daily-backup.sh |
| Script Status | Created |
| Script Size | 523 bytes |
Script contents:
dd if=/dev/zero of=/tmp/disk_pressure.img bs=1M count=400Reason: Detected as destructive/high-risk disk operation
| Item | Status |
|---|---|
| Command | dd if=/dev/zero of=/tmp/disk_pressure.img ... |
| Result | Blocked |
| File Created | None |
dd if=/dev/zero is a destructive command pattern that writes large amounts of data to disk. wiiiv automatically blocks this command even when explicitly requested by the user, and suggests safer alternatives instead. This is rule-based blocking, not an AI judgment call — it cannot be bypassed.
Content:
ssh.executeReason: Dangerous command detected —
\brm\s+(-[rf]+|--recursive|--force)
Do you want to proceed?
SSH Tips
No need to know the commands
Say "Analyze SSH login failure IPs" and wiiiv builds a 20-line journalctl + awk pipeline. Specialized tools like nftables, sysctl, and vmstat are all used through conversation.
Pre-register your connection details
Instead of entering passwords directly in conversation, you can pre-register SSH hosts in wiiiv settings. Registered hosts connect by name only, and connection details are stored encrypted on the server.
sudo tasks through conversation
Tasks requiring admin privileges — firewall setup (T4), kernel tuning (T8), cron registration (T9) — just say the word. The password provided at connection is automatically used for sudo authentication.
Dangerous commands are automatically blocked
OsHazardGuard detected two hazardous patterns: dd if=/dev/zero (T10) and rm -rf (T11). Blocking is rule-based, independent of AI judgment — so even if the AI accidentally generates a dangerous command, you're safe.
It goes beyond execution — it analyzes
In T3, it assessed MariaDB's all-interface binding as "Caution." In T7, it traced the nginx-check error to a "shebang issue." It doesn't just run commands — it performs analysis and diagnosis.
When verification fails, it says so honestly
In T4, after applying firewall rules, the nft list output was empty — and wiiiv reported "unable to confirm." It does not disguise an unverified result as success.