SrvPulse

Docs / Install the agent

Install the agent

One binary, outbound 443 only.

1. Install

# Debian / Ubuntu
curl -fsSL https://pkg.srvpulse.net/gpg | sudo tee /usr/share/keyrings/srvpulse.asc >/dev/null
echo "deb [signed-by=/usr/share/keyrings/srvpulse.asc] https://pkg.srvpulse.net/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/srvpulse.list
sudo apt update && sudo apt install srvpulse-agent

# RHEL / Alma
sudo dnf config-manager --add-repo https://pkg.srvpulse.net/rpm/srvpulse.repo
sudo dnf install srvpulse-agent

2. Enrol

The agent resolves the nearest collector itself. Override with --collector when you want a specific region.

sudo srvpulse-agent enrol --token spt_4Kd91x... --collector api.srvpulse.net

  ✓ collector            api.srvpulse.net:443
  ✓ transport            grpc (h2)
  ✓ workspace            ws_41c7
  ✓ client certificate   valid until 2027-05-02
  ✓ checks received      18

3. Configure

# /etc/srvpulse/agent.yaml
workspace: ws_41c7
collector:
  endpoint: api.srvpulse.net:443
  transport: grpc          # grpc | websocket
  compression: gzip
  keepalive: 45s
  spool:
    path: /var/lib/srvpulse/spool
    max_size: 512MiB
collect:
  host: true
  containers: true
  systemd: [nginx, postgresql, redis-server]
probes:
  - id: api-health
    type: http
    target: https://api.internal/healthz
    interval: 30s
    expect: { status: 200, tls_min_days: 14 }
sudo systemctl enable --now srvpulse-agent
srvpulse-agent status

4. Verify the path

If samples are not arriving, check the path to the collector before anything else. The linkcheck command pulls a fixed 2 MiB payload and reports what actually got through.

srvpulse-agent linkcheck --collector api.srvpulse.net

  TLS handshake   ok   (TLS 1.3, X25519, 12ms)
  ALPN            h2
  payload         2097152 bytes in 0.21s  (9.5 MiB/s)
  round trip      ok   (11ms)

# by hand
curl -s -o /dev/null -w '%{size_download} %{time_total}\n' \
  https://api.srvpulse.net/static/probe/linkcheck-9c42.bin
A short read — anything well below 2097152 — means something on the path is cutting the response, not that the collector is down. Corporate middleboxes and some mobile carriers do this to TLS destinations they do not recognise. Switch transport to websocket and run linkcheck again before opening a ticket.

Troubleshooting

SymptomCauseFix
enrol: 403 token_usedtoken already exchangedissue a new one
collector: unavailableegress 443 blockedallow *.srvpulse.net:443
spool growingcollector unreachablerun linkcheck
clock skewdrift > 90senable NTP
h2 GOAWAY too_many_pingskeepalive below minimumkeepalive: 45s or higher