What the agent collects
The agent is a single Go binary that observes and summarizes only. It never runs remediation, never opens an inbound port, and never accepts a command from the server.
What it collects
| Collector | What it reports |
|---|---|
| Host | Hostname, OS and version, kernel, architecture, CPU (model, vendor, family, vCPUs / cores), total RAM and swap, the virtualization platform, mounted filesystems with size, uptime, the running vs newest-installed kernel, a stable machine fingerprint |
| Metrics | System metrics such as CPU, memory and disk usage over time |
| Packages | Installed packages, pending updates, security updates, and whether a restart is required |
| Services | Running and failed services (failed units are named), and for each failed unit why it stopped: systemd’s result category, the exit code or the signal that killed it, its restart count and since when it has been down. Metadata from systemd’s own accounting — never journal content |
| Domains | Domains served, read from local Apache / Nginx virtual hosts |
| Certificates | TLS certificates in use, with issuer, subject and expiry |
| Firewall & ports | Listening ports (and whether each is exposed to the world), the firewall backend and default policy, its rules where readable, and fail2ban jails |
| Package history | Past apt runs — when, which command, and which packages changed. Read from the host’s own apt log, so it covers changes made before Demerzel was installed. Never who ran them. |
Most of this comes from world-readable files and /proc. The one gap is a firewall’s own rule list, which is usually root-only — the agent still detects the firewall and its ports, and you can optionally export the rules for it to read.
How often
Collection runs on the interval you set with --interval (default one minute). Metrics benefit from a short cadence; inventory-style facts change rarely and are only re-sent when they actually change. Package history is bounded to the last 12 months and 500 transactions, so an old machine’s log can’t turn into an enormous first upload. Everything is summarized on the host before transmission — Demerzel receives compact facts, not raw log streams.
Idempotent by design
Each observation carries a unique, time-ordered id, so retries and overlapping runs never create duplicates. If the network blips, the agent simply sends again — the server records each fact exactly once.