Installing unfamiliar software on a production server is a decision that deserves suspicion. This page exists for that suspicion: it describes exactly what the AgentWatch agent collects, where it connects, which files it installs and how to remove it cleanly, so you or your infrastructure team can audit everything before running a single command.

This is the narrative version. For the definitive one — no login required, and always describing the exact script and binary you would actually download — see the in-app agent transparency page.

What is the AgentWatch agent?

The agent is one Go binary, roughly 8MB, with no dependencies and no bundled runtime, built by AgentTech with a published checksum. It runs as a systemd service on your server, reads system metrics on a cycle and reports to AgentWatch over HTTPS, one request every 30 seconds.

It ships for linux amd64 and arm64, so it runs on anything from a commodity VPS to Oracle Ampere, AWS Graviton or a Raspberry Pi. The agent is what gives your dashboard the half that external checks can never see: CPU, RAM, disk, services and containers, as described on the server monitoring page.

What does it collect, and what does it refuse to collect?

The collection list is strictly operational metrics:

  • CPU, RAM, swap, load average and uptime, read from /proc.
  • Disk partition usage, as percentage used.
  • The Docker container list: name, image, state, restart count, health result.
  • Active or inactive status of the systemd services you choose to watch.
  • Results of calling an internal health endpoint on localhost that you configure.

And the equally important list of commitments about what it will not do:

  • No reading of logs, files, source code or application data.
  • No reading of environment variables, secrets or database contents.
  • No network traffic capture.
  • No remote command execution. The central server only returns configuration: reporting interval and the list of services to watch.
  • No self-updating. Upgrades happen only when you deliberately re-run the install command.

How does the agent use the network?

Exactly one connection, in one direction. The agent opens an outbound HTTPS connection to the AgentWatch server to deliver its reports, and it opens no ports whatsoever on your machine. Nothing on the internet can call into the agent, because there is nothing to call.

Authentication uses a per-machine token, revocable at any time from the dashboard with the Rotate token button. If you configure an internal health probe, that probe may only call localhost or 127.0.0.1, rejects every other host and never follows redirects, so it cannot be abused to scan your internal network. This probe is one of the three layers of Docker container monitoring.

How is it installed, and which files land on disk?

From the dashboard, you add a server in agent mode. The system issues a per-machine token and a one-line install command:

curl -fsSL https://monitor.agenttech.com.vn/agent/install.sh | sudo bash -s -- --token <token>

Prefer to audit first? Fetch the script and read it with curl -fsSL .../agent/install.sh | less before deciding to run anything. The script downloads the binary for your CPU architecture, verifies its SHA-256 checksum automatically, installs exactly the 3 files below and starts the service:

Path Contents
/usr/local/bin/agentwatch-agent The agent binary
/etc/agentwatch/agent.env URL, token, interval. Mode 600, root-readable only
/etc/systemd/system/agentwatch-agent.service systemd unit, restarts on failure

Verify with systemctl status agentwatch-agent, watch it work with journalctl -u agentwatch-agent -f, and note the logs never contain the token. Within about 30 seconds the machine shows as active on the dashboard.

Why root, and how is it contained?

The agent runs as root because it needs to read /var/run/docker.sock to list containers. In exchange, the systemd unit bolts it down twice: NoNewPrivileges=true blocks every privilege escalation path through setuid, and PrivateTmp=true isolates its temp directory. Beyond the 3 files above, the agent writes nothing else to disk.

This trade-off is stated openly rather than buried. If your servers do not run Docker and your internal policy is stricter, talk to us at support@agenttech.com.vn before installing.

How do upgrades and removal work?

Upgrading is re-running the same install command; no token needed, since the existing configuration is preserved. Complete removal takes four commands, deleting exactly the 3 installed files and leaving nothing behind:

sudo systemctl disable --now agentwatch-agent
sudo rm -f /usr/local/bin/agentwatch-agent /etc/systemd/system/agentwatch-agent.service
sudo rm -rf /etc/agentwatch
sudo systemctl daemon-reload

Making it easy to leave is part of the design. You can also delete servers and your entire account from the dashboard, no strings attached.

What does the agent cost?

The Free plan covers 2 servers with the agent. Paid plans run from 49,000 VND per month for 5 servers up to Business at 399,000 VND for 50, detailed on the pricing table, with the feature overview on the homepage. During the beta, new accounts get the Business plan free.

If everything above passes your audit, the next step takes 3 minutes: create an account, run one command, and your server starts telling its own story.