Skip to main content

Install the Wakora agent on RHEL, Rocky, Alma, CentOS Stream and Fedora

Tested on Rocky Linux 9 and 10, CentOS Stream 9 and Fedora, on amd64 and arm64. AlmaLinux and RHEL itself share the same packaging and behave the same way.

Install​

curl -fsSL https://get.wakora.io | bash -s -- --key <YOUR_TEAM_KEY>

curl and openssl are the prerequisites; both ship with every minimal image. The installer re-runs itself through sudo when needed, writes and enables wakora-agent.service, registers the host and starts the service. The unit is hardened (read-only system tree except the agent's own directories, 30% CPU quota, lowered priority, an OOM score that sacrifices the agent before your services).

What the agent finds on a RHEL-family host​

  • the package inventory from rpm, and pending updates from dnf check-update;
  • the security picture straight from the advisories: the count of security updates, the split by severity (critical, important, moderate, low) and the CVE identifiers the advisories carry. Fedora's dnf5 publishes advisories without CVE references, so on Fedora you get the counts and the severity split but not the per-CVE list from dnf; the CVE correlation done on the platform side from the package inventory covers it instead;
  • systemd units, failed units, OOM kills, SSH activity from the journal;
  • every recognised service from the catalog: Apache as httpd (with its sites from httpd -S), MariaDB or MySQL, PHP-FPM from the Remi or AppStream packages, Postfix, Docker, and so on;
  • host metrics: CPU, memory, swap, disks, load, network, top processes.

Verify​

wakora doctor
systemctl status wakora-agent
tail -f /var/log/wakora/agent.log

Notes​

  • Reboot detection on this family keys off /var/run/reboot-required. RHEL-family systems do not create that file by themselves (their tool for it is needs-restarting), so a pending kernel reboot is not flagged here unless something on the host writes that file.
  • The agent runs dnf in query mode only (check-update, updateinfo); it never installs, removes or updates a package.
  • MySQL and MariaDB probes use the local socket as root. On AppStream installs where root has a password, store a monitoring user once with sudo wakora secret set mysql; see Monitoring MySQL and MariaDB.
  • Apache metrics carry the svc.httpd.* prefix on this family, because the process is httpd; the rules are the same as for Debian's apache2. See Monitoring Apache.

Next: First start, Fleet deployment.