DataReel Reporting Agent for Linux Documentation Downloads
New October 2026

DataReel Reporting Agent for Linux

A small C++ service for RHEL 8, 9 and 10 that sends a report about its host every 15 minutes to a report server: system, usage, security settings, updates, the Red Hat security advisories that apply, and the installed packages. The host only makes outgoing HTTPS connections, so the DataReel System Monitor can watch it over the internet, from behind NAT or a firewall, with no SSH access.

Install the agent Set up the report server Vulnerability scans What's new

What it reports

System

Release, kernel, vendor, model, serial number, virtualization, time zone and IP addresses.

Usage

CPU, iowait, steal, load, memory, swap, every local file system (space and inodes) and network traffic, with the same metric names as DRSM's SSH plugins, so the trend graphs work.

Security settings

SELinux, firewalld or nftables, auditd, FIPS, sshd root and password login, automatic updates, logged in users, accounts with a login shell and failed systemd units.

Updates

Pending package updates, the last package install, and whether a restart is needed for a new kernel.

Vulnerabilities

The Red Hat security advisories the host still needs, with severity, CVEs and fixed packages, from OpenSCAP (RHEL 8 and 9) or Red Hat CSAF/VEX data (RHEL 10). Off by default.

Hooks

Site checks in /etc/drra/report.d run with every report, and reports from other tools are sent with the agent's hook uploads.

How it works

The agent is the drra program, run by the drra.service systemd unit. Every 15 minutes (report_interval_minutes) it writes a plain text report and delivers it. On its first run it creates an RSA key and a certificate and registers the certificate with the report server. After an admin approves the host, or it sends the right enrollment token, every report it uploads is signed, and the server only accepts reports that are signed by the host they claim to be from.

How the DataReel Reporting Agent for Linux works: each Linux host runs the drra service, which registers its certificate and uploads signed reports over HTTPS to the PHP pages on a report server, or copies them to a file share or SSH server. DRSM reads the reports and shows the hosts, their alerts, trends and vulnerabilities on its dashboard. Linux hosts RHEL 8, 9 and 10, cloud or on site drra.service (systemd) report every 15 minutes RSA key + certificate Report server Apache + PHP, local or hosted register.php upload.php, hook.php admin.php, vex_index.php Reports one text file per host + scan HTML Admins approve or revoke hosts DRSM alerts, trends, CVEs Or a file share / SSH smbclient copy, scp signed HTTPS

The report can also, or instead, be copied to a Windows file share (with smbclient) or to an SSH server. The reports are plain text files, one per host. The DataReel System Monitor (DRSM) checks agent hosts from their last report with its lra collector and linux/* plugins, and shows every host's advisories on its Vulnerabilities page.

Who it is for

DRSM monitors Linux hosts it can reach over SSH without any agent. The agent is for the hosts it cannot reach:

It is the Linux counterpart of the DataReel Reporting Agent for Windows and uses the same signed upload protocol, so one report server and one DRSM dashboard can take both.

Get started

1. Set up the report server

Copy the PHP pages to an Apache and PHP host with install_server.sh. Shared hosting works.

2. Install the agent

Install the RPM for RHEL 8, 9 or 10, set the server in /etc/drra/drra.ini and start the service.

3. Approve the hosts

Check each host's key fingerprint on the admin page, or use an enrollment token.

4. Add the hosts to DRSM

Point DRSM at the reports and make a host file for each agent with lra_hosts.sh.

Other documentation