Install the agent

The agent comes as an RPM for RHEL 8, 9 and 10 (and rebuilds such as Rocky Linux, AlmaLinux and Oracle Linux) for x86_64.

What you need

RHEL 8, 9 or 10, x86_64, with systemd.
A report server with the PHP pages, see Set up the report server, and its enrollment token if you use one.
Outgoing HTTPS (port 443) to the report server. Nothing needs to connect to the host.
For vulnerability scans on RHEL 8 and 9: openscap-scanner. For compliance scans: scap-security-guide.
For CIFS or SCP delivery: samba-client or openssh-clients.

Install the RPM

Download the RPM for your release from the downloads page (el8, el9 or el10) and check it against its .sha256sum file:

$ wget https://datareel.com/downloads/linux_reporting_agent/linux_reporting_agent-1.1-1.el9.x86_64.rpm
$ wget https://datareel.com/downloads/linux_reporting_agent/linux_reporting_agent-1.1-1.el9.x86_64.rpm.sha256sum
$ sha256sum -c linux_reporting_agent-1.1-1.el9.x86_64.rpm.sha256sum
# dnf install ./linux_reporting_agent-1.1-1.el9.x86_64.rpm
# dnf install openscap-scanner          # RHEL 8 and 9 vulnerability scans

The RPM installs the agent, its settings, the systemd unit and a logrotate file, and makes the drra-upload group. It does not start the service: set the server first.

Set the server

All settings are in /etc/drra/drra.ini (root only, as it can hold the enrollment token). For a report server at reports.example.com with the pages in /linux/upload/:

[delivery]
methods=https

[https]
host=reports.example.com
upload_path=/linux/upload/upload.php
register_path=/linux/upload/register.php
enrollment_token=     ; from server.ini, or empty to approve by hand

[scan]
enabled=1             ; optional, see Vulnerability scans

See Configuration for every setting.

Start the service

# drra report | less                    # look at a report, nothing is sent
# drra fingerprint                      # key fingerprint for the admin page
# systemctl enable --now drra
# tail /var/log/drra/drra.log

The first cycle registers the host. Without an enrollment token the log says the agent is pending: approve it on the admin page (Approve hosts), and the next report goes through. systemctl reload drra starts the next report now. Settings are read again before every report, so a changed drra.ini needs no restart.

Commands

Command	What it does
`drra run`	Runs as a service: a report every `report_interval_minutes` (systemd uses this)
`drra once`	Writes and sends one report, scanning first when a scan is due
`drra report`	Prints a report, nothing is sent
`drra scan`	Runs the vulnerability (and compliance) scan now
`drra hooks`	Runs the report hooks and prints their HOOKS section
`drra submit --hook <id> [--now] <file>`	Queues a report from another tool for upload hook <id>; `--now` asks the service to send it right away
`drra send-uploads`	Sends the queued upload files now, without a report
`drra uploads`	Lists the upload hooks and their state
`drra register`	Registers the agent certificate with the report server
`drra fingerprint`	Prints the agent key fingerprint to check on the admin page
`drra config`	Prints the settings in use
`drra version`	Prints the version

-c <ini file> uses another settings file, for example to test against a development server.

Installed files

Path	Contents
`/usr/sbin/drra`	The agent
`/etc/drra/drra.ini`	Settings, with comments (mode 0600)
`/etc/drra/report.d/`	Report hooks, see Hooks
`/etc/drra/uploads.d/`	Upload hook files
`/usr/lib/systemd/system/drra.service`	The systemd unit, hardened (read only `/usr`, `/boot` and `/etc`, private `/tmp`, no new privileges)
`/var/lib/drra/`	Agent key and certificate, registration state, last report, scan results and feed cache
`/var/log/drra/drra.log`	Log of every report and upload (rotated by logrotate)
`/var/spool/drra/uploads/`	Hook upload spool, writable by the `drra-upload` group
`/usr/share/doc/linux_reporting_agent/`	README, license, the report server pages (`php/`) and the DRSM files (`drsm/`)

Upgrade and remove

dnf install a newer RPM to upgrade: the service restarts and drra.ini, the key and the registration stay. dnf remove linux_reporting_agent stops and removes the service; /var/lib/drra and /var/log/drra stay until you delete them. Delete the host on the admin page too, or a reinstall with a new key gets key_mismatch.