feat: sysmon should report available disks/mounts #737

New issue

Open

opened 2026-03-28 04:27:59 +00:00 by mfreeman451 · 0 comments

mfreeman451 commented

2026-03-28 04:27:59 +00:00

Owner

Imported from GitHub.

Original GitHub issue: #2286
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/2286
Original created: 2026-01-14T07:47:33Z

Is your feature request related to a problem?

Since sysmon is now baked into serviceradar-agent, it would be make configuring the sysmon profiles in the admin/settings UI easier if we knew ahead of time what available mount points we have, based on actual mount points on each system that has an agent installed and sysmon enabled.

Lets update sysmon to report more information back up to the agent-gateway/core about the host system so we can present some more options/hints to the user about what filesystems they might want to setup monitoring for. We should make this robust enough so that if a user had 100k agents and some hosts had hundreds of mount points or something like that, we get rid of outliers like that and don't make this huge list or array of labels/suggestions that blow up our UI, we basically just need to find the most common 5 partitions and probably also filter out the ones that users will most likely never need to monitor on a linux (rhel, debian) or osx system.

sysmon should be able to be enabled/disabled on an agent from the UI and the config.json
when sysmon starts up, should send information about the host to the agent-gateway immediately, basic information such as network interfaces and assigned IP addresses, VLANs, mount-points / filesystems used (ext4, zfs, xfs, etc), hwinfo, what version of Linux (kernel/distribution), etc
agent-gateway forwards this information to core-elx for processing
core-elx processes initial agent/sysmon discovery information, turning interfaces into the correct network interface Ash Resource, storing it in CNPG, and associating it with that host
apache-age graph type stuff out of scope for this change
must enrich ocsf_devices record for this agent with the additional information we need to be sending up from sysmon to agent-gateway -> core-elx
consider arp table processing, but this might be better suited for serviceradar-mapper, which is going to get merged into serviceradar-agent next

Describe the solution you'd like

A clear and concise description of what you want to happen.

Describe alternatives you've considered

A clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context or screenshots about the feature request here.

Imported from GitHub. Original GitHub issue: #2286 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/2286 Original created: 2026-01-14T07:47:33Z --- **Is your feature request related to a problem?** Since sysmon is now baked into serviceradar-agent, it would be make configuring the sysmon profiles in the admin/settings UI easier if we knew ahead of time what available mount points we have, based on actual mount points on each system that has an agent installed and sysmon enabled. Lets update sysmon to report more information back up to the agent-gateway/core about the host system so we can present some more options/hints to the user about what filesystems they might want to setup monitoring for. We should make this robust enough so that if a user had 100k agents and some hosts had hundreds of mount points or something like that, we get rid of outliers like that and don't make this huge list or array of labels/suggestions that blow up our UI, we basically just need to find the most common 5 partitions and probably also filter out the ones that users will most likely never need to monitor on a linux (rhel, debian) or osx system. - [ ] sysmon should be able to be enabled/disabled on an agent from the UI and the config.json - [ ] when sysmon starts up, should send information about the host to the agent-gateway immediately, basic information such as network interfaces and assigned IP addresses, VLANs, mount-points / filesystems used (ext4, zfs, xfs, etc), hwinfo, what version of Linux (kernel/distribution), etc - [ ] agent-gateway forwards this information to core-elx for processing - [ ] core-elx processes initial agent/sysmon discovery information, turning interfaces into the correct network interface Ash Resource, storing it in CNPG, and associating it with that host - [ ] apache-age graph type stuff out of scope for this change - [ ] must enrich ocsf_devices record for this agent with the additional information we need to be sending up from sysmon to agent-gateway -> core-elx - [ ] consider arp table processing, but this might be better suited for serviceradar-mapper, which is going to get merged into serviceradar-agent next **Describe the solution you'd like** A clear and concise description of what you want to happen. **Describe alternatives you've considered** A clear and concise description of any alternative solutions or features you've considered. **Additional context** Add any other context or screenshots about the feature request here.