Open app
Docs/Installing the Agent

Run the agent as a service

For real monitoring you want the agent running continuously and restarting on boot. On Linux, the simplest way is a systemd service.

One command does everything below — it creates the unprivileged demerzel user, sets up the identity, and installs, enables and starts the service:

curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh

The script is careful about the identity so you never enroll twice:

  • if you already enrolled as your own user (the common case — you ran demerzel-agent --enroll … and it stored things under ~/.config/demerzel), it migrates that identity to the service user. No token needed.

  • if nothing is enrolled yet, pass your enrollment token and it enrolls for you:

    curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s <your-token>

It’s idempotent — safe to re-run. To change the collection interval, set DEMERZEL_INTERVAL (default 1m):

curl -fsSL https://get.demerzel.cloud/service.sh | sudo DEMERZEL_INTERVAL=30s sh

Once it finishes, follow the logs with journalctl -u demerzel-agent -f, then confirm the data is arriving in Verify & troubleshoot.

Or set it up by hand

If you’d rather do each step yourself, here’s exactly what the script does.

Create a system user

Run the agent as an unprivileged user that owns only its config directory:

sudo useradd --system --home /etc/demerzel --shell /usr/sbin/nologin demerzel
sudo mkdir -p /etc/demerzel
sudo chown demerzel:demerzel /etc/demerzel
sudo chmod 700 /etc/demerzel

Give it an identity

If you already enrolled as your own user, move that identity over instead of enrolling again:

sudo cp -a ~/.config/demerzel/. /etc/demerzel/
sudo chown -R demerzel:demerzel /etc/demerzel

Otherwise, enroll now — the files land owned by root, so hand them to the service user afterwards:

sudo demerzel-agent --config-dir /etc/demerzel --enroll <your-token>
sudo chown -R demerzel:demerzel /etc/demerzel

Define the service

Create /etc/systemd/system/demerzel-agent.service:

[Unit]
Description=Demerzel agent
After=network-online.target
Wants=network-online.target

[Service]
User=demerzel
ExecStart=/usr/local/bin/demerzel-agent --config-dir /etc/demerzel --interval 1m
Restart=on-failure
RestartSec=10
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/etc/demerzel /usr/local/bin

[Install]
WantedBy=multi-user.target

Enable and start

Let the service user replace its own binary, so --update (and auto-update, if you opt in to it) works in place, then start it:

sudo chown demerzel /usr/local/bin/demerzel-agent
sudo systemctl daemon-reload
sudo systemctl enable --now demerzel-agent
sudo systemctl status demerzel-agent
Choosing an interval. 1m is a good default for metrics and health. The agent is deliberately light — collection is read-only and summarized before it leaves the host.
Certificates renew themselves. The agent’s identity certificate is deliberately short-lived (~30 days). A running agent renews it automatically well before expiry over its existing mTLS connection — there is nothing to rotate by hand, and no long-lived credential sitting on the host.

Check the logs any time with journalctl -u demerzel-agent -f. Next, confirm the data is arriving in Verify & troubleshoot.