Skip to main content

Hosts (Virtual Machines)

Overview​

This topic describes how to install Upwind Sensor on a Linux host (VM), such as an Amazon EC2 instance, Google Cloud compute instance or Microsoft Azure VM, Oracle Compute instance or a on-premise VM.

note

This topic assumes the following criteria are met:

  • You have already connected the cloud account where the Host is hosted to Upwind. If you haven't, please follow the Connect a Cloud Account page.

Requirements​

The Upwind Sensor can be installed on any Linux machine with a kernel version of 4.14 or above.

The Upwind Host installation includes two components: the Sensor (the always-on agent) and the Scanner (periodic host scanning). The Sensor is lightweight, needing only 0.5 CPU cores and 512 MiB of memory. The Scanner is limited by default to half a CPU core and 20% of the host's memory, up to 4 GiB. The install script sets up the Scanner only on hosts with at least 7,000,000 kB (about 6.7 GiB) of total memory, so 8 GiB hosts qualify; on smaller hosts the Sensor runs normally without the Scanner. To change the threshold, set UPWIND_SCANNER_MIN_HOST_MEM (in kB). The deb and rpm packages always enable the Scanner, with a 4 GiB memory limit.

Here's a table summarizing the requirements:

RequirementDescription
Architectureamd64 or arm64
Operating SystemLinux
Init Systemsystemd
Kernel Version4.14 or above
Kernel ConfigurationBPF enabled (CONFIG_BPF=y). The installer checks for it in /boot/config-<kernel release>.
Kernel Filesystemdebugfs or tracefs, read and writable
Toolstar, used by the installer
CPU (Sensor)0.5 cores or more
Memory (Sensor)512 MiB or more
CPU (Scanner)Limited to 0.5 cores by default
Memory (Scanner)Host with about 6.7 GiB or more (install script). Uses up to 20% of host memory, at most 4 GiB

Please make sure your Host meets the above requirements before proceeding with the installation.

The installer detects which Sensor variant the host needs. If the kernel is built with BTF (CONFIG_DEBUG_INFO_BTF=y), it installs the standard Sensor. Otherwise it installs the BCC variant for older kernels, which runs the Sensor as a container and also needs:

  • A container runtime: Docker, nerdctl, or Podman.
  • A package manager (apt-get, dnf, yum, or zypper). The installer uses it to install the kernel headers for the running kernel.

To choose the variant yourself, set UPWIND_AGENT_INSTALL_TYPE. Refer to Environment Variables.

RecommendationDescription
Kernel Version5.4 or above

Installation​

The installation choices available for deploying the Upwind Sensor are as follows: