From zero to first decommission in 15 minutes.

Fernwake is built so an SRE can install it, find their worst ghost, and sunset it before lunch. This guide walks through that whole arc.

Install in 5 minutes

The Fernwake CLI runs from your laptop or any host that can reach your infrastructure. The agentless scan mode is the fastest way to see results.

# macOS / Linux
$ curl -fsSL https://get.fernwakeconsole.com | sh

# Or via Homebrew
$ brew install fernwake/tap/fernwake

# Or via npm
$ npm install -g @fernwake/cli

Sign in with the email you used to register. Fernwake opens a browser tab and stores a token in ~/.fernwake/config.toml.

$ fernwake login

# Opens https://app.fernwakeconsole.com/cli/auth in your browser
✓ Signed in as ada@example.com (workspace: example)

Heads up. The CLI is read-only by default. It cannot start, stop, or modify any process on your hosts unless you explicitly enable a write-capable agent profile.

Your first scan

Run an agentless sweep against your inventory. This works over SSH, kubeconfig, or your cloud provider's read-only IAM.

$ fernwake scan --since=30d --output=summary

→ Discovering hosts...      47 found
→ Polling cron tables...    412 entries
→ Polling systemd units...  684 active
→ Polling K8s pods...       787 running

✓ Scan complete · view: https://app.fernwakeconsole.com/scans/0e8b6c

Open the resulting URL in your browser to see the full inventory, with ghosts pre-filtered and ranked by risk.

Claiming a ghost

The console marks any process without a current owner as a ghost. Adopting one is two clicks — or one CLI command:

$ fernwake adopt clean_tmp.py --team=platform --justification="nightly /tmp cleanup; should not be removed"

✓ Adopted by team:platform
✓ Justification recorded
✓ Sunset proposal closed (if any was open)

Integrations · AWS

Create a read-only IAM role in your AWS account. Fernwake provides a CloudFormation template that grants exactly the permissions needed — nothing more.

# Deploy the read-only role
$ fernwake aws connect --account-id 123456789012 \
    --regions us-east-1,eu-west-1

# Or apply the template directly
$ aws cloudformation deploy \
    --template-url https://templates.fernwakeconsole.com/aws-readonly.yaml \
    --stack-name fernwake-readonly

Integrations · Kubernetes

Apply the Fernwake collector as a regular Helm release. It runs as a DaemonSet, mounts no host paths beyond /proc, and ships only metadata — never process arguments or stdout.

$ helm repo add fernwake https://charts.fernwakeconsole.com
$ helm install fernwake-agent fernwake/agent \
    --set workspace=example \
    --set token=$FERNWAKE_TOKEN

Integrations · GitHub

Connect with a GitHub App that needs only Contents: read and Metadata: read. Fernwake uses commit and PR history to attribute ownership of binaries it discovers.

Integrations · Slack

Install the Fernwake Slack app and pick a channel. New ghosts post there with adopt / suppress buttons — your team can triage from inside Slack without ever opening the console.

Owner attribution

Fernwake's attribution engine combines four sources, ranked by recency and weight:

1. Git history — most recent author who touched the binary or its deploy manifest
2. Ticket history — Jira / Linear tickets that mention the process or host
3. Recent chat — Slack mentions of the process name in the last 90 days
4. Manual claim — anyone with workspace access can adopt and override

If a candidate appears in your SSO directory as deactivated, the process is automatically flagged as orphaned.

Sunset workflow

Sunsetting is a four-step lifecycle: propose → dry-run → approve → commit. Every step is logged.

$ fernwake sunset clean_tmp.py --dry-run
$ fernwake sunset clean_tmp.py --propose --reviewers=@maria,@dan
$ fernwake sunset clean_tmp.py --status

# Once approved, the process enters the 14-day quiet-kill window:
#   - cron entry is disabled
#   - binary stays on disk
#   - Fernwake watches for downstream errors
# After 14 days with no incidents, the cleanup is finalized.

Alert routing

Route new ghosts and stale-process digests to the right channel. Fernwake supports Slack, Microsoft Teams, PagerDuty, OpsGenie, Grafana OnCall, and generic webhook.

CLI reference

The Fernwake CLI is the canonical interface. Anything you can do in the web console, you can do here.

• fernwake scan — run an ad-hoc inventory sweep
• fernwake doctor — quick health check across connected integrations
• fernwake adopt <id> — claim ownership of a process
• fernwake sunset <id> — propose / approve / commit a decommission
• fernwake export — dump your inventory to CSV / JSON / Parquet
• fernwake audit — query the audit log

Self-hosting

The Fernwake control plane runs on any Kubernetes cluster v1.26+. We ship a Helm chart and an AMI for those who prefer VMs. Storage is Postgres + S3-compatible blob store.

Audit logs

Every authenticated action — login, adoption, sunset, integration change — is recorded in an append-only audit log. Stream it to your SIEM via syslog, Splunk HEC, or Datadog Logs.