Linux

Linux agent installation

The v1.3 installer detects Debian/Ubuntu, RHEL/Alma/Rocky, or CentOS/RHEL 7, installs lightweight runtime libraries (including nftables), builds a release binary, and registers a systemd service with CPU and memory limits.

Requirements

• ✓ Ubuntu 20.04+, Debian 11+, RHEL/CentOS 7+, AlmaLinux, or Rocky Linux
• ✓ Root or sudo for install and log/interface access
• ✓ Outbound HTTPS (443) to your portal API and to portal.trivla.com for license validation
• ✓ Valid TRIVLA license key

Quick install

# From the agent directory in the TRIVLA repo
git clone https://github.com/trivla/trivla.git
cd trivla/agent
sudo bash scripts/install-linux.sh

# Apply and renew your license key (always validates via portal.trivla.com)
sudo trivla-agent license set trvl_YOUR_LICENSE_KEY
sudo trivla-agent license renew
sudo trivla-agent license status

# Configure portal endpoint (self-hosted example)
sudo trivla-agent config set portal.url https://portal.example.com/api/v1
sudo trivla-agent config set agent.name edge-01

# Verify connectivity, then start
sudo trivla-agent status
sudo systemctl enable --now trivla-agent

Dependencies installed automatically

The installer detects your package manager and installs build tools (during install) plus runtime libraries only:

• ✓ libcurl + openssl — TLS portal and license communication
• ✓ sqlite3 — local agent token and license cache
• ✓ ca-certificates — certificate verification
• ✓ nftables — portal IP whitelist (always allows TRIVLA infrastructure)

Configure capture interfaces (single or multiple)

List only the NICs you want monitored for up/down alerts — one interface (eth0) or several (eth0,eth1). Unlisted NICs are ignored. Set locally or in the portal (Agents → Config):

[portal]
url = https://portal.trivla.com/api/v1
license_key = trvl_YOUR_LICENSE_KEY

[agent]
name = edge-01

[capture]
interfaces = eth0,eth1

Log pattern alerts (portal-pushed)

Configure log watchers on the portal; the agent pulls them every 120 seconds:

{
  "log_watchers": [{
    "id": "sshd-fail",
    "path": "/var/log/auth.log",
    "pattern": "Failed password",
    "regex": false,
    "severity": "HIGH",
    "cooldown_seconds": 120
  }]
}

Inspect monitoring settings (portal or CLI)

View log watchers and interfaces in the portal (Agents → Config) or on the host:

sudo trivla-agent config show --live   # pull config from portal
sudo trivla-agent logs status          # log paths + readability
sudo trivla-agent interfaces status    # NIC operstate vs monitored set
sudo trivla-agent firewall status      # portal IP whitelist

Portal IP whitelist

The agent always allows traffic to TRIVLA infrastructure (139.99.243.178, 139.99.243.179, 139.99.179.10) via nftables table inet/trivla, so customer firewall rules cannot block license or portal traffic.

Verify installation

sudo trivla-agent status
sudo trivla-agent interfaces list
sudo journalctl -u trivla-agent -f