Service collectors
Exporter scrapes, log watches and config drift — gathered by the agent from inside the network.
Collectors are what the agent gathers beyond host vitals.
Exporter scrape
The agent scrapes a Prometheus-format endpoint on localhost and forwards the metrics.
Loopback only, and SSRF-guarded. An agent that could be told to fetch an arbitrary URL would be a request-forgery primitive inside your network with a credential attached.
This is how a service that exposes metrics but is not publicly reachable gets monitored without opening anything.
Log watches
The agent watches logs and reports rates, not presence.
| Source | Reads |
|---|---|
| Container | Container logs |
| Journal | journald |
| File | A path on disk |
Journal and file sources matter: container-only was the significant gap, because the things that break at 3 a.m. — sshd, the kernel, systemd, a cron job — do not run in containers.
A watch reports a rate, not a match. "Error X appeared" is noise on a busy box; "error X went from 2/hour to 400/hour" is a signal.
Health documents
The agent reads the application's own health document and sends it whole.
Not a count of failures: a check added on the application side must appear in AccelerUp with no change on the agent side, and a count cannot carry a name.
Shapes are detected automatically — Spatie-style, Spring Actuator, generic. The parser is shared with the control plane, so a document read by either route produces the same result.
| Limit | Value |
|---|---|
| Body cap | 2 MB |
| Flush interval | 15 s |
| Batch | 30 |
| Minimum interval | Enforced — these endpoints do real work, often opening a database connection |
Config drift
The agent reports hashes of configuration files, never contents. A file that differs from its peers is drift; what is in it is not sent anywhere.
Local secrets
Collectors that need credentials read them from a local secrets file. They are redacted unconditionally in everything the agent sends, including error messages and terminal transcripts.
A past issue is worth knowing about: health-spec headers once expanded local secrets into requests to any URL, while the scrape path had a loopback bound. The two now share the same bound. If you add a collector that interpolates secrets, give it the same restriction — the credential is the thing that makes an unbounded URL dangerous.
Coverage
Coverage tells you which services on a box have no collector — the gap between what is running and what is watched.
Where this behaviour lives: backend/cmd/accelerated/scrape.go, backend/internal/domain/agent_collectors.go. If the code and this page disagree, the code is right — please fix the page.
Part of Fleet — The agent on each server: what it collects and what it may be asked to do.