How the Alert Logic Agent Works

If you're using Alert Logic® in the Cloud, you're likely deploying the Alert Logic Agent. Read on to gain a greater understanding of what the Alert Logic Agent is used for and why it is so important.

• Agent Education
• Agent Installation
• Performance Impact
• Platform Support
• Health State Alerts

Agent Education

Alert Logic utilizes agents within our network intrusion detection system (IDS) and log management services as the means of collecting host information from our customers and clients. The agents copy only the necessary information and send it back to Alert Logic for analysis. In the simplest terms, agents are the means that our network IDS and log management services use to collect data and logs about network activity taking place within your protected environments.

The network IDS aspect of the agent binds to the network interface of the machine on which the agent has been installed and collects copies of the network traffic sent to and from the host.

The log management aspect of the agent collects logs from host machines where the agent is installed. It is integral to the usefulness of both services that agents are installed on your host machines. Without agents, you are potentially limiting Alert Logic's view into your cloud environment.

Agents are required for the network IDS and log management services to work properly in a cloud environment. In on-premises environments, however, agents are not required, but can be helpful. With network IDS, agents provide more insight into the traffic seen at a host level, beyond mere traffic in and out of the network. With log management, agents allow for easier deployment and management.

Note: Agents stop caching data after they have been offline for over 90 days.

Pro tip: The network IDS and log management services are, by default, set to auto-update. Make sure that your environments allow for auto-updates! If you do not have automatic updates enabled, then you will need to manually apply updates. Otherwise, agents will not run the latest software. At some point, lack of new updates may cause performance issues. Updates need to be applied to get the full value and effect of new features and functionality.

Agent Installation

Step-by-step instructions on installations are available. Start here to Install the Alert Logic agent for Windows. And start here to Install the Alert Logic agent for Linux.

You need only manage a single install for both services. The Alert Logic Agent's single install makes the installation process more efficient and less resource-intensive on the host.

Performance Impact

Agents have little impact and overhead on customer systems. Because they run as a service, the entire system will not need to be rebooted if there is an issue with the agent. In that case, only the agent service would need to be restarted. On top of that, agents use almost no hard drive space.

Collection Frequency

The Alert Logic Agent periodically checks for log data to send to Alert Logic, based on the log generation rate of the protected host. An agent will check for data as frequently as needed to keep up with the log generation rate, but at least once every 5-10 minutes. If no data has been seen from a specific source (such as a single Event Log stream) for more than two weeks, the check interval increases with a maximum of 12 hours between checks. An agent will attempt to send data more frequently if it detects local log storage space is filling up.

Platform Support

Amazon Linux is supported by the Alert Logic Agent. Amazon Linux instances are highly based on CentOS/Red Hat Linux, which we do currently support and will work to maintain support with the latest available releases. Alert Logic has a number of customers running the agent on Amazon Linux instances.

OS Platforms that support Alert logic agent deployment:

Note: Amazon WorkSpaces is not supported.

Health State Alerts

Note: The following information applies only to Alert Logic customers with Cloud Defender ™ entitlements.

Agents generate health state alerts based on their condition within your environment. Below, learn more about agent health state alerts and what exactly they mean for the agent's current condition.