Agent & SSH Login History

The Zenavo agent

Setup installs the Zenavo agent on every server, in its own zenavo-system namespace. The agent connects out to the control plane over HTTPS and carries the control plane's Kubernetes requests to the local cluster: deployments, logs, terminals, files and status checks. Because the connection goes out from the server, no port needs to be open for Zenavo, and Zenavo stores no credential for the cluster. What the agent may and may not do is in Firewall & Security.

The server's Server Info tab shows whether the agent is connected, and Connects through shows whether it reaches the control plane directly or through one of Zenavo's relays. A server whose agent stops answering shows Offline after a few minutes; projects on it keep running (Manage a Server).

Update the agent

Settings shows the agent's version. When a newer one is available, a team admin clicks Update agent. The agent updates itself to Zenavo's agent image, pinned by its digest; no SSH or setup is needed. The current agent keeps running until the new one has connected, so nothing is interrupted. If the update does not finish, the setting says so and links to the job log.

An update can start once the server is running and no other job is in progress on it.

Servers added before the agent

Servers added before the agent existed are moved to it automatically. Settings → Connection shows the state and starts the move at once (Servers added before the agent). Features that need the agent, such as SSH login history, start working after the move.

SSH login history

The server's SSH tab lists who logged in to the server over SSH, for team members and up:

• Source IPs: each address that logged in, with its country and city, the users and methods it used (password or key), the number of successful logins and failed attempts, and when it was first and last seen. Addresses that are new in the period are marked New.
• Time range: the last 24 hours, 7 days, 30 days or 90 days.
• Include failed login attempts: off by default, so the list shows only addresses that logged in. Turn it on to also see addresses that only failed, which are mostly internet-wide password scans.

Zenavo emails the team the first time an address logs in successfully to one of its servers: the New SSH login source notification. It is expected after you connect from a new network, and a warning sign otherwise. Logins older than a day when Zenavo first sees them, for example after the control plane was away, do not send an alert.

How it is collected

The agent runs without root and cannot read the server's logs, so setup installs a small collector that can. A systemd timer runs it as root every five minutes. It reads only new sshd entries from the journal and keeps hourly totals per source IP, user and method for the last seven days, in a directory only the agent's group may read. The agent never sees the raw logs, and the collector has no network access and sends nothing itself.

The control plane copies the totals through the agent every few minutes and keeps them for 90 days. Addresses are placed with an offline city database; they are never sent to another service. A connection counts once: as a login if it was accepted, otherwise as one failed attempt. User names that are not plain names are recorded as ?.

If the tab says there is no report yet, the server was set up before login history existed: Settings → Run setup installs the collector. Servers not reached through the agent show no history until they are moved to it.

API

Method	Path
GET	/api/servers/{sid}/ssh-logins?hours=&failed=	Login history (members): hours is 24, 168, 720 or 2160 (default 168); failed=1 also lists addresses that only failed. Returns the collector's state (active, waiting or unsupported), totals and one row per source IP
POST	/api/servers/{sid}/agent/update	Update the agent to the current image (admins; returns a job)
POST	/api/servers/{sid}/agent	Move a server added before the agent to it now (admins; answers 202 with the server, and the move runs as a job)