Ubuntu Pro Updates Fleet

Ubuntu Pro Updates — Fleet

Fleet-wide Ubuntu package update status from ubuntu-pro-updates-exporter, which reads the Ubuntu Pro client's machine-readable API (no subscription required).

What it shows

• Fleet stat row — hosts up, hosts with pending security updates, hosts needing a reboot (Livepatch-aware), ESM-locked fixes on unattached hosts (pending_attach).
• Trends — pending updates by pocket (standard-security, standard-updates, esm-apps, esm-infra), CVE exposure by priority and fix status, installed-package origins.
• Per-host status table — one row per host, linking to the companion Ubuntu Pro Updates — Host dashboard.
• Top CVE tables — CVEs seen across the fleet over the dashboard range, top by number of affected hosts and sorted by CVSS score, with a CVSS >= min filter variable; kernel CVEs are split out, and the packages behind the top CVEs get their own table.

Requirements

• Prometheus scraping the exporter, with the instance label reading as a hostname (strip the :10052 port in relabeling so metric and log labels line up).
• Loki receiving the exporter's JSON logs (any shipper). The CVE tables are fed by logs; run the exporter with --log.format=json --log.cves (and ideally --log.package-updates --log.installed-packages for the host dashboard). Log streams need a job label (dashboard variable, default ubuntu-pro-updates-exporter) and an instance label matching the metric one.
• CVE data needs pro client 35 or newer on the hosts.

Notes

• Log tables are capped at the query line limit; exceptionally large fleets truncate rather than error.
• The exporter repo ships this dashboard, the host companion, starter alert rules, and a docker-compose demo with real data to try it on.