Agent stand-alone Installation

Introduction

The Stealthium Guest Agent can be installed on it's own to look at the data that it collects. It can't connect to the larger Stealthium ecosystem on it's own, so it is limited, but provides a way to evaluate the types of information Stealthium can gather. Much of the power of Stealthium is in correlation of events across guests and systems, a single agent only provides a small part of that picture.

Installation

Download the stealthium-agent Debian package for your Ubuntu version from the Stealthium releases page — assets are named like stealthium-agent_<version>-1_amd64_ubuntu-24.04.deb — then install it:

sudo dpkg -i stealthium-agent_<version>-1_amd64_ubuntu-24.04.deb

Conflicts with the full client

stealthium-agent and the full stealthium client package conflict — installing this one removes the client on a host that has it. Use the stand-alone agent on evaluation machines only.

If there are dependency issues, resolve them:

sudo apt-get install -f

Start the service:

sudo systemctl start stealthium-agent

Check the status:

sudo systemctl status stealthium-agent

Enable the service to start on boot (optional):

sudo systemctl enable stealthium-agent

Examining the data

The stand-alone agent runs with --stdout json, printing every Hyperprint as one JSON object per line, which journald captures. You can evaluate what it has captured by using some of these examples.

View the last ten events:

journalctl -n 10 -u stealthium-agent --no-pager

Stream all CUDA events (the event types are named CudaMemEvent, CudaKernelLaunchEvent, CudaMemcpyEvent, …):

journalctl -f -u stealthium-agent | grep Cuda

Watch all DNS events in a pretty printed format (using jq):

journalctl -f -u stealthium-agent --output json | jq -r '
    .MESSAGE | fromjson | select(.type == "DnsEvent")
'