Identity
The agent names itself from the monitored host’s /etc/hostname (read via the /host mount), so it stays a single Agent row across container restarts rather than creating a new one per container id.
Check-in loop
POST /api/agent/checkin/ runs every REEF_POLL_INTERVAL seconds (default
15). It upserts the agent by hostname and returns the enabled scan types, the
poll interval, and canceled_job_ids — jobs an operator canceled, which the
agent abandons if it’s the one currently running.
An optional metrics block — CPU/RSS of the agent container plus host memory
and load — rides along on check-in, throttled to one stored sample per
REEF_METRIC_MIN_INTERVAL_SECONDS (default 20s).
Offline detection
An agent is marked offline after REEF_AGENT_OFFLINE_AFTER_SECONDS of silence
(default 300s). The reaper skips any agent that currently has a
claimed/running job, so a slow scan alone never trips a false offline alert.
Keepalive during long scans
A scan (ClamAV especially) can run for many minutes, during which the agent makes no HTTP calls on its own. To avoid both a false “offline” alert and a missed cancel, the agent runs each scan on a worker thread and checks in every 30 seconds from the main thread — that same check-in is how a cancel reaches a mid-scan agent.
Resource metrics & the profiling page
GET /api/agents/— every agent, with its per-type last scan and latest resource sample.GET /api/agents/<name>/— one agent’s 24h CPU/mem summary, latest sample, and its 25 most recent finished scans (with duration + peak CPU/mem).GET /api/agents/<name>/metrics/?hours=— resource time-series (up to 800 points) plus scan windows for the range; this drives the/agents/<name>/profiling page.
Samples older than REEF_METRIC_RETENTION_DAYS (default 14) are pruned hourly
by beat.