The Outpost agent
The Outpost agent is the software that turns a computer into a managed endpoint. It runs as a service, reports the computer’s inventory and health to your Outpost, and carries out the work your team sends it: scripts, patches, software installs, policy, and remote sessions. This page explains how the agent works so you can deploy it, plan your network rules, and support it.
How the agent connects
Section titled “How the agent connects”The agent connects outbound to your Outpost on TCP port 443. It never listens for inbound connections, so you do not open ports on the endpoint or on your firewall for management.
The connection uses mutual TLS 1.3:
- During enrollment, the agent creates a key pair on the endpoint and presents a single-use enrollment token. Your Outpost signs a certificate for that endpoint and returns the certificate authority the agent trusts from then on.
- After enrollment, every connection is authenticated by that certificate. The private key never leaves the endpoint.
- The certificate is valid for 90 days, and the agent renews it automatically 30 days before it expires. An endpoint that was turned off long enough for its certificate to expire can still reconnect within a grace period. See Bring endpoints back from storage.
- When an endpoint is retired, its certificate is revoked and the agent can no longer connect.
If the endpoint reaches the internet through a proxy, the agent can use an HTTP proxy that you set when you download the installer. See Deploy the agent at scale.
What the agent reports
Section titled “What the agent reports”| Report | Default interval | What it contains |
|---|---|---|
| Heartbeat | 60 seconds | That the agent is alive and connected. |
| Check-in | Set by the monitoring.telemetry_interval_seconds profile setting | Standard health metrics. |
| Inventory | Collected every hour and sent when it changes, plus a full copy once a day | Hardware, operating system, installed software, network, users and sessions, services, and security state. |
| Live metrics | Only while a technician is watching | Processor, memory, disk, network, and the process list. |
The heartbeat, check-in, and full inventory intervals are profile settings in
the monitoring category. See Automation.
Each endpoint also reports what it is able to do on its operating system. The console uses that list to tell “this endpoint cannot do that” apart from “this endpoint found nothing”, and to explain why a control is unavailable. See Supported platforms.
An endpoint that stops reporting appears in the Gone quiet view under Endpoints. By default, an endpoint unseen for 30 minutes raises an alert. See Troubleshoot the agent.
What runs on the endpoint
Section titled “What runs on the endpoint”| Platform | Service | Runs as | Program files |
|---|---|---|---|
| Windows | OutpostAgent (Outpost Agent) and OutpostWatchdog (Outpost Watchdog) | LocalSystem | C:\Program Files\Outpost\Agent |
| Linux | outpost-agent (systemd) | root | /opt/outpost |
| FreeBSD and OpenBSD | outpost_agent (rc.d) | root | /opt/outpost |
| macOS (Preview) | com.outpost.agent (LaunchDaemon) | root | /usr/local/outpost |
The agent keeps its configuration, certificate, and private key in one directory that only administrators can read:
- Windows:
C:\ProgramData\Outpost - Linux, FreeBSD, OpenBSD, and macOS:
/etc/outpost
The agent restarts if it stops, on every platform. On Windows, the watchdog service also restarts an agent that stops responding, and puts the previous version back if an update fails. On Linux, the BSDs, and macOS, the service manager restarts the agent, and the agent itself puts back the previous version after a failed update.
Some work has to happen in the signed-in user’s own session, such as capturing the screen for a remote session. For that, the agent starts a helper process in that session when it is needed.
The tray app
Section titled “The tray app”On Windows and macOS, the installer also installs the
Outpost tray app, the part of Outpost the end user sees. The agent
decides whether the tray runs, based on the tray.enabled profile setting.
Updates
Section titled “Updates”The agent updates itself. Every 4 hours it checks for a newer build, verifies its signature, installs it, and restarts. A new build that does not run correctly is rolled back to the previous one. The agent updates the tray app the same way. You can also check for and install an update on one endpoint from the console. See Agent and tray updates.
Related
Section titled “Related”Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.