An agent is the small Reef container that runs on each monitored host. It runs scans and reports results back to the Reef server. See How Reef Works for what the agent can access.
Agent names
Each agent names itself after the host it monitors, using the host’s hostname. Because of this, an agent keeps the same identity and history across container restarts and upgrades. To use a different name, set REEF_AGENT_NAME in the agent’s .env file.
Check-ins
Each agent checks in with the Reef server every 15 seconds by default (REEF_POLL_INTERVAL). A check-in tells the server the agent is healthy, picks up any scans that are due, and receives cancellation requests.
During a long scan, such as a full ClamAV sweep, the agent keeps checking in about every 30 seconds. As a result, busy hosts aren’t mistaken for offline ones, and you can still cancel a scan that is in progress.
Offline detection
If an agent goes silent for 5 minutes (REEF_AGENT_OFFLINE_AFTER_SECONDS), Reef marks it offline and raises a notification. This matters for continuous monitoring, because an offline agent means that host is no longer being scanned. Agents in the middle of a scan are never marked offline.
Resource usage
Click an agent to open its detail page, which shows:
- The agent’s CPU and memory use over time, along with the host’s memory use and system load
- When each scan ran, overlaid on the resource charts
- The 25 most recent scans, with each one’s duration and peak CPU and memory use
This helps you confirm that scanning isn’t affecting production workloads and choose scan schedules that fit each host. Resource history is kept for 14 days by default (REEF_METRIC_RETENTION_DAYS).