Universal Agents

The Kentik Universal Agent collects availability, health, and performance telemetry from your network infrastructure. To extend the agent's functionality, install one or more Agent Capabilities on a host machine (see Universal Agent Deployment).

Did You Know?: All Kentik Agents will gradually be replaced with Agent Capabilities of the Kentik Universal Agent.

Agent Capabilities

Agent capabilities are the operational functions of an agent that allow it to perform tasks. Features of Kentik’s Universal Agent include:

• Automatic self-updates

• Sends host metrics and capability metrics to Data Explorer and Metrics Explorer

• Support for alert creation based on agent and capability metric conditions

Supported Capabilities

The following table describes the different capabilities that Kentik Universal Agent supports, the methods to implement them, use cases, and related workflows.

For capability deployment and management through the portal, see Deploy a Universal Agent Through the Portal and Universal Agent Portal Management.

For capability deployment and management through the API, see Deploy a Universal Agent Through the Kentik API and Kentik's API Repo on GitHub. Kentik APIs provides an introduction to the Kentik API.

Notes:

• A Universal Agent capability identifier matches its binary name. See Find the Capability Identifier for instructions.

• The DNS OTT Tap capability replaces the standalone kprobe software agent as the method for tapping DNS data, as described in Enable OTT DNS Collection.

• The Flow Proxy and SNMP/ST capabilities replace the standalone kproxy software agent as the method for forwarding flow telemetry data.

• Some capabilities may be Early Access. Contact your Kentik Account Team for more information.

Find the Capability Identifier

To find the binary name (capability identifier) of a Universal Agent capability through the portal, follow these steps:

1. Go to the Universal Agents page via Settings » Universal Agents in the Kentik portal's navbar.

2. Under Agents, click an agent row. Clicking an agent row opens the Agent Details drawer.

3. In the Agent Details drawer, click Installed Capabilities to display the capabilities paused or running on the agent.

4. Click Details next to the capability you wish to view.

5. In the capabilities detail page, find the Binary field. This field displays the binary name (capability identifier).

System Requirements

When deploying Universal Agents and enabling capabilities, ensure your host machine meets the necessary hardware requirements for optimal performance. Hardware needs scale based on the volume of telemetry data and the specific capabilities enabled. For details on running multiple capabilities simultaneously, see Understanding Agent Workload Scaling.

Understanding Agent Workload Scaling

Running multiple capabilities with a single agent is a convenient deployment model. However, each additional capability compounds resource utilization, and workload contention can require significantly more CPU and memory to sustain equivalent performance.

Another common factor can be environmental and whether the traffic being ingested from sources such as Flow, syslog and traps occurs in bursty patterns or consistently over time. Highly volatile traffic patterns can require additional resources to properly scale the workload for reliability.

Supported Operating Systems

The Universal Agent is built and validated against the following distributions. Kentik utilizes modern toolchains that require specific library versions (e.g., glibc) found in these releases.

Support Matrix

The following table details the Linux distributions, supported operating system versions, and package formats validated for Universal Agent deployment.

Legacy and Unsupported Systems

Kentik does not support the installation of the Universal Agent on distributions that have reached vendor End of Life (EOL).

• CentOS 7: Officially unsupported. Internal capability workflows do not support building against CentOS 7 or any Enterprise Linux version prior to version 8.

• Other EOL Distros: Any distribution version not explicitly listed in the Support Matrix is considered unsupported.

WARNING: Attempting to install the Universal Agent on unsupported systems will likely result in installation failures due to missing dependencies or runtime execution errors.

Agent Status

A deployed Universal Agent can be in one of the following states, as indicated in the Status column of the Universal Agents list:

• Up: The agent was last seen by Kentik within 30 minutes.

• Down: The agent was last seen by Kentik over 30 minutes ago.

• Not Authorized: The agent is not yet authorized to connect to Kentik.

Note: Authorization is part of the agent installation process (see Universal Agent Deployment).

Network & Firewall Allowlist Requirements

This section details the network firewall requirements for the Universal Agent, including required outbound SaaS endpoints and local inbound ports.

Outbound SaaS Egress Rules

To ensure complete agent functionality and to prevent telemetry data loss, your perimeter firewalls must permit outbound egress traffic from the Universal Agent host to Kentik SaaS endpoints. All communication between the agent and Kentik SaaS is strictly outbound and encrypted using TLS over TCP port 443. Blocking required endpoints, such as api.kentik.com or grpc.api.kentik.com, can interrupt capability operations, software updates, and telemetry ingestion.

The Universal Agent strictly initiates all outbound connections to Kentik SaaS endpoints and encrypts all traffic using TLS 1.2 or higher over TCP port 443. At the application layer, the agent transmits data using standard HTTPS or HTTP/2-based gRPC. If your network uses Deep Packet Inspection (DPI) or SSL inspection proxies, your security policies must permit gRPC traffic over port 443.

The following table describes outbound rules from the agent host to Kentik SaaS.

Note: EU and EMEA tenants must replace *.kentik.com with *.kentik.eu endpoints.

Local Network Ingestion Rules

In addition to perimeter egress, internal network and host firewalls must allow local infrastructure to communicate directly with the Universal Agent host. The agent acts as a local receiver, using standard listening ports to capture telemetry (NetFlow / sFlow on UDP port 9995, SNMP polls on UDP port 161, and syslog server on UDP/TCP port 514). Certain capabilities may also require bi-directional or outbound local connections (SSH config scraping on TCP port 22, BGP peering sessions on TCP port 179) (see Agent Capabilities).

The following table describes the rules for internal network firewalls or host firewalls (iptables / ufw / Windows Firewall) allowing devices to communicate with the Universal Agent.