Agent guide
The agent is a small program that runs on a computer at the site. It checks the cameras and recorders on the local network and connects out, so there are no ports to open. Here is how to install it, upgrade it, and what to check when something is off.
Downloads
Always the latest version. Pick the file for the computer the agent will run on; on Linux, uname -m tells you which one.
| System | uname -m | File |
|---|---|---|
| Linux 64-bit (PC or server) | x86_64 | sentinel-agent-linux-amd64.tar.gz |
| Linux ARM 64-bit (Raspberry Pi 4/5 with a 64-bit OS) | aarch64 | sentinel-agent-linux-arm64.tar.gz |
| Linux ARM 32-bit (Raspberry Pi with a 32-bit OS) | armv7l | sentinel-agent-linux-armv7.tar.gz |
| Windows 10/11 or Server 2016 and later | — | sentinel-agent-windows-amd64.zip |
Published versionChecksums (SHA256SUMS)
To verify a download, get SHA256SUMS into the same folder and run:
Install
- Linux with systemd, or Windows 10/11 or Server 2016 and later.
- The computer’s clock synced by NTP: when it runs more than 2 minutes ahead or 10 minutes behind, Sentinel drops what the agent sends.
- Outbound Internet access on port 8883. No inbound ports are needed.
- The computer on the same network (or VLAN) as the cameras.
Create the agent in the app, under Monitoring → Agents → New agent. The next page shows the command for the system you pick, with the broker, the agent id and the key already filled in, and the secret, once. Copy the command from there; the ones below are the same with the values marked.
On ARM, replace linux-amd64 with linux-arm64 or linux-armv7. The installer asks for the secret, so it stays out of the terminal history. It then creates the service and starts it; within a minute the agent shows as Online in the app. To see its state on the computer:
Upgrade
Upgrades are manual for now. The installer in upgrade mode replaces the program and keeps the enrollment and the configuration. The app shows each agent’s version under Agents.
Uninstall
This removes the service, the credentials, the configuration and the data key from the computer. Then revoke the agent in the app.
Network
- Outbound TCP to Sentinel’s broker on port 8883 (MQTT over TLS).
- UDP multicast to 239.255.255.250:3702 and its replies on the LAN, to find ONVIF cameras. Routers do not pass that multicast between subnets: the agent has to be on the cameras’ VLAN.
- HTTP or HTTPS to each camera’s ONVIF port, and the RTSP port for devices that only offer RTSP.
- A corporate proxy that inspects TLS breaks the connection unless its certificate is installed on the system.
Troubleshooting
- The agent does not show as Online
It is usually the clock. The log says “system clock is NOT synchronised” or “no configuration from Sentinel”. Turn time sync on. On Windows: w32tm /resync, with the Windows Time service running.
- Credentials rejected
When the agent was revoked or its credentials rotated in the app, the broker rejects it. Rotate the credentials in the app and run the install command again with the new key.
- No cameras found
Discovery only reaches the agent’s own network: cameras on another subnet or VLAN do not show up. On Windows, check that the firewall rule “Sentinel Agent (WS-Discovery replies)” exists; the installer creates it.
- A camera says auth_failed
The camera rejected the username and password stored in the app. Fix them before trying again: many Hikvision and Dahua devices lock the account after a few failed attempts.
- Linux: ping says not_permitted
The agent pings without privileges. When sysctl net.ipv4.ping_group_range shows “1 0”, allow it with this command and the devices are checked again:
Logs: journalctl -u sentinel-agent (Linux) and C:\ProgramData\Sentinel Agent\logs\agent.log (Windows).