Working with the Docker agent

After you provision an instance of the IBM Cloud Monitoring service in the IBM Cloud, you can deploy the Monitoring agent as two Docker containers in supported hosts to collect data and metrics automatically. You can configure which metrics to monitor in each environment.

You can associate one or more tags to each monitoring agent. Tags are comma-separated values that are formatted as TAG_NAME:TAG_VALUE. When you monitor your environment, you can use these tags to identify metrics that are available from an agent. For example, you can include information about the service name and location with all of the metrics that are collected by this agent.

Prereqs

Review Tune Agent

Deploying a monitoring agent as two Docker containers

When you configure a monitoring agent directly on a Linux host as standard Docker containers, you may need to install external linux headers to launch the monitoring agent correctly.

For example, you might need to run the following command to install external linux headers:

apt-get -y install linux-headers-$(uname -r)

Notice that when you use a MacOS with a container that returns ...-linuxkit with the command uname -r, it is most likely not compatible.

Complete the following steps to configure a monitoring agent on two Docker containers to collect and forward metrics to an instance of the IBM Cloud Monitoring service:

Obtain the access key. For more information, see Getting the access key through the IBM Cloud UI.
Obtain the public or private ingestion URL. For more information, see collector endpoints.

Deploy the monitoring agent. Run the following command:

docker run -it --privileged --rm --name sysdig-agent-kmodule \
-v /usr:/host/usr:ro \
-v /boot:/host/boot:ro \
-v /lib/modules:/host/lib/modules \
quay.io/sysdig/agent-kmodule

Run the monitoring agent:
```
docker run -d --name sysdig-agent \
--restart always \
--privileged \
--net host \
--pid host \
-e ACCESS_KEY=[MONITORING_ACCESS_KEY] \
-e COLLECTOR=[COLLECTOR_ENDPOINT] \
[-e TAGS=[TAG_DATA]]
-v /var/run/docker.sock:/host/var/run/docker.sock \
-v /dev:/host/dev \
-v /proc:/host/proc:ro \
-v /boot:/host/boot:ro \
--shm-size=512m \
quay.io/sysdig/agent-slim
```
Where
- MONITORING_ACCESS_KEY is the ingestion key for the instance.
- COLLECTOR_ENDPOINT is the public or private ingestion URL for the region where the monitoring instance is available. To get an endpoint, see Collector endpoints.
- TAG_DATA are comma-separated tags that are formatted as TAG_NAME:TAG_VALUE. You can associate one or more tags to your monitoring agent. For example, role:serviceX,location:us-south.

The container runs in detached mode. To see the container’s output, remove -d.

Checking the version of an agent by using the CLI

To check the version of an agent, run the following command:

docker exec sysdig-agent /opt/draios/bin/dragent --version

Checking the status of an agent by using the CLI

To check the status of an agent, run the following command:

docker ps | grep sysdig-agent

You can run docker ps -a to see all the containers that are running.

The list of running containers is displayed. Check that a container with name sysdig-agent is listed.

Finding agent logs

To see the agent logs, you can run the following command:

docker logs sysdig-agent

Viewing the logs of an agent

To look for errors, you can run the following command to view the logs:

docker logs sysdig-agent 2>&1 | grep "error"

Updating a Docker agent

Complete the following steps to remove the monitoring agent that is deployed as a container in a Linux system:

Stop the monitoring agent container. Run the following command:
```
docker stop sysdig-agent
```
Remove the monitoring agent container. Run the following command:
```
docker rm sysdig-agent
```
Get the latest version of the monitoring agent. Run the following command:
```
docker pull sysdig/agent
```
Install the agent. Learn more.

Removing the monitoring agent containers

Complete the following steps to remove a deployed monitoring agent:

Stop the monitoring agent container.

Run the following command:
```
docker stop sysdig-agent
```
Remove references to the monitoring agent container.
```
docker rm sysdig-agent
```