Ubuntu Pro Updates Host

Single-host view of package-update and CVE exposure from ubuntu-pro-updates-exporter: metrics plus the full per-item lists from the exporter's JSON logs, anchored to the newest snapshot.

Ubuntu Pro Updates — Host

Single-host drill-down for ubuntu-pro-updates-exporter: everything one Ubuntu host's package state has to say, picked with a host selector filled from the exporter's own metrics. Companion to the Ubuntu Pro Updates — Fleet dashboard, whose host table links here.

What it shows

Stat row — exporter health, data age, pending updates, pending security updates, reboot required (Livepatch-aware), pro client version.
Trends — pending updates by pocket, CVEs by priority and fix status.
Exact lists, resolved from logs — the current pending-update list (package, version, pocket, status), the installed-package manifest, and CVE⇄package pairs ranked by CVSS score (kernel CVEs split out). A snapshot anchor exported by the exporter ties the log lines to the metrics, so the tables show exactly the current list — including removals — not a log tail.
Exporter log stream for the selected host.

Requirements

Prometheus scraping the exporter, instance label as hostname (strip the :10052 port in relabeling).
Loki receiving the exporter's JSON logs: run with --log.format=json --log.package-updates --log.installed-packages --log.cves. Streams need a job label (variable, default ubuntu-pro-updates-exporter) and a matching instance label.
CVE data needs pro client 35 or newer.

Notes

The default 2-day range is deliberate: with exporter defaults an unchanged list's newest snapshot can be up to ~36h old, and a shorter range would leave the list tables empty. Keep that slack if you narrow it.
Kernel CVE panels are empty on hosts without kernel packages (e.g. containers); on real hosts they light up.
List tables are capped at the query line limit; unusually large hosts truncate rather than error.

Revisions