Install the agents
Add your other servers with one command per server, or enroll many servers with a single command.
Agents are installed from your master: the other servers don't need the release package. The install command downloads the program from the master, verifies its SHA-256 checksum, writes /etc/3rmonitor/agent.conf, creates the 3rmonitor-agent service (running as the unprivileged user 3rmonitor-agent) and its root helper 3rmonitor-helper, trusts the master's signing key and your passkeys, and sends a test report.
Each server needs Linux with systemd, root access, curl or wget, and outbound access to the panel address. See Requirements.
Option 1: one server at a time
Use this when you add servers one at a time.
In the panel, open Servers and click ＋ Add server. Enter a Name (for example "Main web server"), choose a Group, and click Register and get install command.
Copy the command and run it as root on that server. It looks like this:
curl -fsSL 'https://monitor.example.com/dl/install.sh?t=TOKEN' | sudo bash -s -- agent --master 'https://monitor.example.com' --token 'TOKEN' --master-key MASTER_FP --approvers PASSKEY_FP--master-key and --approvers are the fingerprints of the master's signing key and of your trusted passkeys. --approvers is only there once you have a passkey.
After a few seconds the server shows its status, operating system, agent version and last report in the Servers list.
Each server has its own token. To see the command again, open the ⋯ menu on the server's row and choose Install command.
Option 2: many servers with one command
Use this to add many servers at once, or from an automation tool.
At the bottom of Servers, under Enroll many servers with one command, turn Enrollment command on, copy the command, which contains the enrollment key, and run it on as many servers as you like. Each server registers itself. The name defaults to the server's host name; add --name and --group at the end of the command to choose them:
curl -fsSL 'https://monitor.example.com/dl/install.sh?t=ENROLLMENT_KEY' | sudo bash -s -- agent --master 'https://monitor.example.com' --enroll 'ENROLLMENT_KEY' --master-key MASTER_FP --approvers PASSKEY_FP --name web-2 --group Production- Change enrollment key → Change: the old command stops working immediately. Servers that are already enrolled are not affected.
- Turn Enrollment command off: servers can then only be added one by one, with ＋ Add server.
Anyone who has the enrollment command can add servers to your panel. Share it only with the people who install servers, and change the key if it leaks.
From the master's command line
You can also register a server on the master and get its token without opening the panel:
sudo 3rmonitor server add --name web-2 --group ProductionIt prints the new server's token. Then, on the new server, run the install command with your panel address and that token:
curl -fsSL 'https://monitor.example.com/dl/install.sh?t=TOKEN' | sudo bash -s -- agent --master 'https://monitor.example.com' --token 'TOKEN'Add --reuse to server add to get the token of an existing server with the same name instead of registering it twice, which is handy in scripts. A server installed this way, without --master-key, doesn't trust your passkeys yet: run sudo 3rmonitor approvers trust on it if you want approved AI repairs there.
Other ways to install an agent
Manual installation explains each of them:
- from the release package, with the program from the package instead of from the master;
- downloading the installer first, to read it before you run it, or to answer its questions;
- with wget on servers without curl;
- from SSH, cloud-init or Ansible;
- completely by hand, without install.sh.
The address agents use
The install commands use the Panel public URL in Settings → General. It must be an address the other servers can reach: not 127.0.0.1, and not a LAN IP if the servers are in other networks.
- If the master uses HTTPS with a self-signed certificate, add
-kto curl (curl -fsSLk …) and--insecureto the end of the command.--insecuresetsinsecure = trueinagent.conf. See A master with a self-signed certificate. - If you change the panel URL later, agents that are already installed keep reporting to the old address. To move them, see the next section.
Re-enroll an agent that is already installed
When an agent should report to another master, use a new token, or replace a server with a new one, you don't need to reinstall it. In Servers → ⋯ → Install command, open Agent already installed? Just re-enroll it as this server and run the command it shows:
sudo 3rmonitor bind --master 'https://monitor.example.com' --token 'TOKEN'Check that it works
On the agent server:
3rmonitor status # installation mode and service status
sudo 3rmonitor agent --test # report once now and show the result
journalctl -u 3rmonitor-agent -f # agent log
journalctl -u 3rmonitor-helper -f # root helper logThe installer's summary shows "The agent runs as the unprivileged user 3rmonitor-agent…". If it shows that this failed, the agent still monitors the server, but the AI runs nothing there until you fix it with sudo 3rmonitor agent secure.
If the server doesn't appear in the panel, see Troubleshooting.
Updates
You don't update agents yourself: whenever you upgrade the master, agents update themselves to the same version (auto_update = true in agent.conf). Agents older than 1.1.0 that ran as root switch to the unprivileged user by themselves when they update. Since 1.1.1, agents only install programs signed by 3R Soft, so install and upgrade the master from the official release package. See Upgrade and uninstall.
Remove a server
- In Servers, open the ⋯ menu on the server's row and choose Delete. Its history is deleted too, and its agent is no longer allowed to report.
- On that server, remove the agent:
sudo bash /opt/3rmonitor/install.sh uninstall.