A port being open does not mean a server is healthy. An SSH check connects to the host and runs one of a fixed set of read-only diagnostics, so you find a full disk or a stopped service before it turns into an outage.
Each SSH monitor runs one diagnostic against one host. Add more monitors for more coverage on the same machine.
Confirm a named service is running. The check that tells you a daemon died quietly at three in the morning.
Watch a filesystem against a threshold you set. Almost every avoidable outage starts with a disk nobody was watching.
Track how much memory is in use, so a leak shows up as a trend rather than as a machine that suddenly stops responding.
Know when a host is working harder than it should be, before the queue turns into timeouts.
Usage checks compare against a limit you choose, so a build server and a database can be judged differently.
Run disk, memory and service checks side by side on the same machine, each with its own interval and its own policy.
SSH access to your servers is the most sensitive thing a monitoring tool can hold. The design keeps it as narrow as possible.
The check is chosen from a fixed list. There is no field where an arbitrary command could be entered, by you or by anyone who gained access to your account.
Every available diagnostic inspects state. None of them write, restart or reconfigure anything.
The account you give Hesklo only needs to run these read-only checks. It does not need root and it does not need write access.
If you do want automated remediation, put it in an HTTP action step in the policy, where it is explicit and separate from the check itself.
Three monitors are free forever. Add an SSH check and draw what happens when a threshold is crossed.