Metric collection
The CPU load, agent process memory, and uptime reported on each heartbeat, how they're read from /proc on Linux, the Windows 0.0 caveat, and heartbeat context fields.
What every heartbeat reports
The agent reports a small, deliberately lightweight set of metrics on each heartbeat — enough to confirm it is alive and show its own footprint, not a full host-monitoring stack.
| Metric | Field | Meaning |
|---|---|---|
| CPU | cpu_usage |
Host CPU load. On Linux, the 1-minute load average from /proc/loadavg. |
| Memory | memory_mb |
Memory used by the agent process itself (Linux VmRSS from /proc/self/status) — not total host memory. |
| Uptime | uptime_secs |
Seconds the agent process has been running. |
These measure different things:cpu_usageis host load, butmemory_mbis the agent process's resident memory. Usememory_mbto watch the agent's footprint (a rising value usually means large or frequent log reads), not host memory pressure.
Heartbeat context fields
Alongside the metrics, each heartbeat carries timestamp, status (e.g. ACTIVE), version, hostname, and capabilities (e.g. ["log_reader"]).
Platform coverage
Metric reading from /proc is Linux-specific. On Windows and other platforms the agent returns 0.0 for cpu_usage and memory_mb; everything else — heartbeats, log collection, command execution — works normally.
For host-wide CPU, memory, disk, and network, pair the agent with the platform’s Infrastructure monitoring; these self-reported values are agent health, not full host coverage.