Installing the agent

Adding a server in the panel (Servers → Add server) mints a single-use enrollment token and prints a ready-to-paste command. The installer detects the operating system and the CPU architecture, so the same one-liner works across Debian, Ubuntu, RHEL, CentOS, Alpine and Windows Server.

Linux

curl -fsSL https://panel.example.com/install.sh | bash -s -- \
  --token <ENROLLMENT_TOKEN> --panel panel.example.com

The script downloads the matching binary (amd64, arm64 or 386), installs it to /usr/local/bin, writes /etc/sentinel/agent.yaml, and registers a service - a systemd unit on most distributions, an OpenRC service on Alpine. It stops any running agent first, because the kernel refuses to overwrite a binary that is executing.

Check it came up:

systemctl status sentinel-agent
journalctl -u sentinel-agent -f

Windows Server

In an elevated PowerShell:

irm https://panel.example.com/install.ps1 | iex
Install-SentinelAgent -Token <ENROLLMENT_TOKEN> -Panel panel.example.com

This installs to C:\Program Files\Sentinel and registers the SentinelAgent Windows Service. For fleet rollout by GPO there is an MSI that takes the same TOKEN and PANEL properties. Windows Server 2016, 2019, 2022 and 2025 are supported on amd64 and arm64.

Get-Service SentinelAgent

What enrollment does

1. The agent generates a keypair on the monitored host and builds a certificate signing request. The private key never leaves the machine.
2. It calls the enrollment endpoint with the token and the CSR. The panel verifies the token, signs a certificate with its internal CA, and returns it with the CA bundle.
3. The token is now spent. Everything after this point is mutual TLS, and the panel identifies the host by certificate fingerprint.
4. The certificate is bound to a device identifier derived from the OS machine identity, so a copied key and configuration will be rejected on a different host.
5. The agent pulls its effective configuration and starts reporting.

What it costs the monitored server

One collection goroutine takes a single snapshot per tick from /proc and /sys - there is no process spawned per metric, which is what makes shell-based collectors expensive. Costly collectors (package updates, SMART, Docker inventory, hardware facts) run on their own long intervals rather than every tick.

Network probes - uptime checks, TLS certificate expiry, ping - run on the panel, not on the agent. Adding those checks costs the monitored server nothing at all.

Upgrading and removing

Re-running the installer upgrades in place. Agent self-updates are pinned to the panel host the agent enrolled against, so a queued update can never pull a binary from somewhere else. To remove an agent, stop and disable the service, delete the binary and /etc/sentinel, then remove the server in the panel to free its slot.