Monitoring
Agents and brokers
See which agents and log brokers are alive, which release they run, what they use, and approve, revoke or remove them.
The Agents page lists every agent and log broker registered in your account. It shows whether each one is alive, which release it runs and how busy it is, and it is where you approve new ones.
Open it from Agents in the top navigation. A green number beside the label counts online agents, and an amber warning icon appears while any agent waits for approval. If the live connection to the control plane drops, a Live updates interrupted. Retrying… chip appears.
The buttons at the top of the page are:
- Add agent and Add broker, which create a join code and the install command. See Agents and Log brokers.
- Downloads, a shortcut to Downloads.
- Remove offline (N), which deletes the records of every agent that isn't online, pending approval or part of a standby pair. If an agent can't be removed, a red notice names the reason and the step that clears it, for example Revoke for an agent that still holds a pipeline whose stop isn't confirmed.
Agent states
Each agent card carries a status chip, based on the time since the agent last reported.
| State | Chip | Meaning |
|---|---|---|
| Pending | Amber | The agent registered but you haven't approved it. It can do nothing until you approve it. |
| Online | Green | The agent reported in the last 30 seconds. |
| Stale | Amber | The agent last reported 30 to 60 seconds ago. It may be busy or have a network problem. |
| Offline | Red | The agent hasn't reported for 60 seconds or more, or it shut down cleanly. |
| Revoked | Red | You revoked the agent. Its credential is refused and it counts as stopped. Select Remove to delete its record. |
When an agent goes offline, every running pipeline that depends on it reads agent offline on the Overview, and its lag and throughput show as unknown until the agent reports again. A red alert at the top of the page names the offline agents and says whether a standby partner has taken over; without a standby, check the agent's service and network connection.
An offline agent may still be running, so its pipelines can't be paused, archived or moved until it is back. If it is lost for good, Revoke it. See High availability: Agents.
Approve, revoke and remove an agent
A new agent appears first on the page, with an Approval required box that says Approve only if you recognize this agent and host.
| Button | Shown on | What it does |
|---|---|---|
| Approve agent | A pending agent | Lets the agent pull its configuration and run pipelines. |
| Reject | A pending agent | Deletes the pending record. The agent must register and be approved again. |
| Revoke | An approved agent | Refuses the agent's credential from now on. A running agent stops on its next contact with the control plane, and it must be installed again with a new join code. Its pipelines move to its standby if it has one; otherwise they pause, and you can archive them or assign them to another agent. |
| Remove | A stale, offline or revoked agent | Deletes the agent's record and unassigns its pipelines. It is refused while the agent still holds a pipeline whose stop isn't confirmed: revoke the agent first. |
| Rename | Every agent | Changes the display name (1 to 128 characters). Pipelines keep running. |
Remove and Reject are disabled for an agent in a standby pair. Select Unlink from HA on the pair first.
You can do the same from a terminal, including sqlflow agent revoke for an agent that is lost while its pipelines are still running. See Agents commands.
What an agent card shows
| Row | Meaning |
|---|---|
| Engine chips | The source and target engines of the agent's active pipelines. |
| Pipelines | The number of active pipelines. Select it to see them. |
| Throughput | Events per second the agent is processing now. |
| CPU | The agent process's CPU use, as a percentage. |
| RAM (working set) | Memory the agent process has resident, including shared pages. |
| Private (Task Manager) | Memory only the agent process holds: the figure Windows Task Manager shows. |
| Agent id | The agent's identifier, with a copy button. The CLI and support ask for it. |
| Version | The release the agent runs, with a version chip. |
| Build | The build identity, with a copy button. Support asks for it. |
| Trust anchors | The control-plane trust set the agent holds, such as Trust v3. An amber Trust: not enrolled chip, or a red chip, means the agent's trust is missing or refused: install it again with a new join code. |
| Last seen | When the agent last reported. – means never. |
Two more items can appear:
- An amber elevated · SeDebug or service-acct chip when the agent runs with an account that might be able to read the SQL Server data files itself. Hover over it to see the account. A log broker is the safer way to give log access. The chip doesn't affect the pipelines.
- An amber line with a fault only the agent can see, for example that its clock is behind the control plane's clock.
Version chips
Agents and brokers are versioned YYYY.M.D.BUILD, where the date is the release date. A release is supported for 12 months from that date. When the chip isn't green, the card also explains why.
| Chip | Color | Meaning |
|---|---|---|
| In window | Green | At least 60 days of support remain. |
| Upgrade soon | Amber | Fewer than 60 days of support remain. |
| Support ended | Red | The release is more than 12 months old. |
| Too new | Red | The component is newer than the control plane, for example after the control plane was rolled back. |
| Unsupported, Unrecognized version, Build denied, Pre-rename build | Red | The control plane doesn't accept this build. |
A component outside the window keeps its pipelines running, but the control plane gives it no new work and may refuse its configuration. Install a current release. See Upgrades and restarts.
Standby pairs
An agent linked to a standby appears with its partner on one ↔ Linked card that shows Active now, Standby, Protected pipelines and a readiness chip. See High availability: Agents to set up, check and unlink a pair.
Brokers
Registered log brokers appear below the agents, under Brokers, with pending brokers first. A broker runs on a database host and serves approved log folders to your agents.
Broker states
| State | Chip | Meaning |
|---|---|---|
| Pending | Amber | The broker registered and awaits your decision. It serves nothing. |
| Approved | Green | You trust this host and certificate. The broker can serve its folders. |
| Revoked | Red | You withdrew trust. The broker stops serving at once. |
The line under the broker's name shows its connection state.
| Line | Meaning |
|---|---|
| No heartbeat yet | The broker hasn't reported yet. |
| Listening for agent connections | The broker is accepting connections. |
| Not listening (<reason>) | The broker isn't accepting connections, and says why. |
| Not reporting | The broker hasn't reported for more than 90 seconds. Its process has probably stopped. |
When an approved broker stops reporting, a red alert at the top of the broker list names it: 1 broker not reporting: <host>. The control plane has missed their heartbeats; check the broker services and connections.
What a broker card shows
| Row | Meaning |
|---|---|
| Version, Build | The release and build, with the same version chips as an agent. |
| Serves | The log folders the broker may read, from its --allow-paths setting. |
| Data port | The TLS version agents use with the broker: TLS 1.3, or an amber TLS 1.2 (host lacks TLS 1.3). |
| From | The addresses allowed to connect, when they are restricted. |
| Details | The Certificate SHA-256 fingerprint and the Runtime identifier, each with a copy button. |
An amber box on the card says why a broker can't serve yet, such as awaiting operator approval. Two reasons need action on the broker host:
The broker process has stopped:
no heartbeat for <time>; the last one (<HH:mm> UTC) said it was listening. The broker process on host '<host>' has probably stopped: start it again.A source database's log is in a folder the broker isn't allowed to serve:
Discovered log path '<path>' of source database '<database>' is outside the log broker's allowed folders (<folders>) on host '<host>'. Rerun 'SqlFlow.LogBroker install' there with --allow-paths including the folder that holds it.
Approve, revoke or delete a broker
Approving a broker is the trust decision. The card says Review the host identity, certificate fingerprint and served folders before approving this broker.
| Button | Shown on | What it does |
|---|---|---|
| Approve | Pending | Trusts the broker. |
| Reject | Pending | Refuses the registration from now on. To register the host again, install the broker with a new data folder and a new join code. |
| Revoke | Approved | Withdraws trust. Pipelines reading through the broker stop. To stop using it as one pipeline's standby instead, use Unlink from HA. |
| Cancel revocation | Revoked | Returns the broker to Pending. |
| Delete | Pending or revoked | Forgets the registration. A broker on that host then registers again as pending. |
| Unlink from HA | A standby broker | Stops using this broker as a pipeline's standby. It stays approved. |
A standby broker shows Standby (HA) broker for and the pipelines it protects. See High availability: Log brokers.
Who can use this page
Every member of the account can see the page. Approve agent, Reject, Revoke, Remove, Rename and the broker buttons need the Account admin or User role. See Accounts and team.
