Pandora FMS EndPoint Deploy Script

Introduction

EndPoint installer for Linux. Always installs from a tarball (never from an RPM), validates the downloaded tarball is a real Pandora FMS EndPoint and configures the agent to report to a Pandora FMS Server.

  • Script: ../pandora_agent_deploy.sh
  • Scope: Pulls from packages.pandorafms.com.
  • Supported OS: RHEL/Fedora (EL7/8/9/10), SUSE/OpenSUSE, Debian/Ubuntu.
  • Supported architectures: x86_64 (binary agents). x86, armv7l, aarch64 auto-switch to PERL_SOURCES (source build). Other architectures abort.

Quick start

Minimal install (GO agent, stable channel): 

export PANDORA_SERVER_IP='10.0.0.1'
curl -sSL https://pfms.me/agent-deploy | bash

Fully automated (no prompts): 

export PANDORA_SERVER_IP='10.0.0.1' \
       PANDORA_AGENT_PACKAGE=GO \
       PANDORA_AGENT_RELEASE=STABLE \
       PANDORA_SKIP_CONFIRMATION=1
curl -sSL https://pfms.me/agent-deploy | bash

Environment variables

Required

Variable Description
PANDORA_SERVER_IP Required. IP address or hostname of the Pandora FMS Server the agent will report to. The script aborts if this is not set.

Package selection

Variable Default Accepted values
PANDORA_AGENT_PACKAGE
(Via
PANDORA_AGENT_PACKAGE_TYPE)
Selects which agent
tarball to install.
See Package selection. 		GO GO,
PERL,
PERL_SOURCES,
or a direct
http(s):// URL
PANDORA_AGENT_PACKAGE_TYPE
Fallback type
used only when
PANDORA_AGENT_PACKAGE
is not set.
Useful when you want
a default type but
still allow callers to
override with a direct URL. 		GO GO,
PERL,
PERL_SOURCES
PANDORA_AGENT_RELEASE
Release channel.
STABLE pulls from …/latest,
BETA
pulls from …/nightlies.
See Release channels. 		STABLE STABLE,
BETA (case-insensitive)
PANDORA_SKIP_CONFIRMATION
When set to 1, skips
interactive confirmation prompts. Use in CICD
and automated pipelines.
See Confirmation. 		unset 1 / unset

Agent configuration (optional)

All of these are injected into /etc/pandora/pandora_agent.conf after install via sed. If a variable is not set, the corresponding config line is left untouched.

Variable Config key affected Effect
PANDORA_REMOTE_CONFIG remote_config Enables/disables remote configuration
from the server.
PANDORA_GROUP group Sets the agent group.
PANDORA_DEBUG debug Enables debug mode
(verbose logging).
PANDORA_AGENT_NAME agent_name Sets the agent name
(uncomments the line).
PANDORA_AGENT_ALIAS agent_alias Sets the agent alias
(uncomments the line).
PANDORA_SECONDARY_GROUPS secondary_groups Sets secondary groups
(uncomments the line).
PANDORA_AGENT_SSL server_ssl Enables SSL for the tentacle connection
(uncomments the line).
TIMEZONE symlink /etc/localtime Sets the system timezone
(e.g. Europe/Madrid).

OS behavior

Variable Default Accepted values Description
RHEL_CHECK_SUBSCRIPTION 1 0 / 1 When 1, on RHEL
(not Oracle Linux)
the script checks subscription-manager
status before installing.
Set to 0 to
skip the subscription check.
PANDORA_SKIP_DEPENDENCIES unset 1 / unset When set to 1,
skips all OS dependency installation
(perl, libnsl, etc.).
Use when you pre-install
dependencies yourself.

Package selection

PANDORA_AGENT_PACKAGE accepts two kinds of values: a type selector or a direct URL.

Type selectors

Value Tarball downloaded (stable) Description
GO pandorafms_one_agent_linux-latest.go.tar.gz Go agent (binary).
Default.
PERL pandorafms_one_agent_linux-latest.tar.gz Perl agent
(pre-compiled binary tarball).
PERL_SOURCES pandorafms_one_agent_linux-latest.src.tar.gz Perl agent from source
(requires Perl on the target machine).
  • The selector is case-insensitive (go, Go, GO all work).
  • PERL_SOURCES also accepts the aliases PERLSOURCES, PERL_SRC, PERLSRC.

Direct URL

If the value starts with http:// or https://, it is used as-is and the default-version logic is skipped. A yellow warning is printed: 

PANDORA_AGENT_PACKAGE is a direct URL,
default version logic (GO/PERL/PERL_SOURCES) is skipped.

The tarball is still validated before install (see Tarball validation), so a wrong URL fails fast instead of installing garbage. 

export PANDORA_SERVER_IP='10.0.0.1' \ 
PANDORA_AGENT_PACKAGE='https://my-ci.example.com/builds/agent-1234.tar.gz'

Invalid value

If PANDORA_AGENT_PACKAGE is set to something that is neither a type selector nor a URL, the script aborts with a red error.

Architecture override

Binary agents (GO, PERL) only work on x86_64. If the script detects x86, armv7l, or aarch64, it automatically overrides the package type to PERL_SOURCES (source build) and prints a yellow warning: 

Arch: armv7l is not supported by the binary agent,
switching to PERL_SOURCES (source build).
Overriding PANDORA_AGENT_PACKAGE from GO to
PERL_SOURCES for arch armv7l.

This override does NOT apply if:

  • The user already selected PERL_SOURCES (no change needed).
  • The user provided a direct URL (respected, but a yellow warning is printed reminding that the arch requires a source build).

Release channels

PANDORA_AGENT_RELEASE chooses between stable and beta (nightly) builds.

Value Base URL
STABLE
Tarball suffix
latest		 https://packages.pandorafms.com/pandorafms/latest
BETA
Tarball suffix
nightlies 		https://packages.pandorafms.com/pandorafms/nightlies

So with PANDORA_AGENT_RELEASE=BETA PANDORA_AGENT_PACKAGE=GO, the downloaded tarball is:

https://packages.pandorafms.com/pandorafms/nightlies/pandorafms_one_agent_linux-nightlies.go.tar.gz.

The value is normalized to uppercase, so beta, Beta, BETA are all accepted. An invalid value aborts with a red error.

BETA warning

When PANDORA_AGENT_RELEASE=BETA, a yellow warning is printed showing the nightlies URL.
Depending on PANDORA_SKIP_CONFIRMATION, the script either asks for confirmation or continues automatically (see Confirmation).

Confirmation

The confirm() function asks the user to type Y or y to continue. It reads from /dev/tty so it works even when the script is piped (curl … | bash).

PANDORA_SKIP_CONFIRMATION PANDORA_AGENT_RELEASE Behavior
unset / not 1 BETA Prints yellow warning + asks Y/y to continue. Aborts on any other answer.
1 BETA Prints yellow warning only, continues without asking.
any STABLE No confirmation prompt (stable does not require it).

CICD / automated usage: always set PANDORA_SKIP_CONFIRMATION=1 so the script never blocks waiting for input. 

export PANDORA_SERVER_IP='10.0.0.1' \
       PANDORA_AGENT_RELEASE=BETA \
       PANDORA_SKIP_CONFIRMATION=1

Tarball validation

After downloading, the script validates the tarball before installing. Two layers:

  1. Structural — tar tzf lists the contents and verifies these entries exist:
    • unix/pandora_agent_installer
    • unix/pandora_agent
    • unix/tentacle_client
  2. Fingerprint — extracts unix/pandora_agent_installer to STDOUT and checks for the string Pandora FMS Agent Installer for Unix.

If either layer fails, the script prints a red error showing the downloaded URL, cleans up the temp directory, and exits. This prevents installing a tarball that is not a Pandora FMS agent (e.g. a wrong URL pointing to a console or server package).

Installation flow

  1. Check PANDORA_SERVER_IP is set.
  2. Check grep, sed, and curl are available.
  3. Detect OS from /etc/os-release (ID_LIKE / ID). Abort if not RHEL/Fedora/SUSE/Debian.
  4. Check root permissions.
  5. Check connectivity to packages.pandorafms.com.
  6. Check architecture. x86_64 continues with the selected package. x86, armv7l, aarch64 auto-switch to PERL_SOURCES (binary agents won't run on these archs). Other archs abort.
  7. Resolve PANDORA_AGENT_PACKAGE (type selector or direct URL) and PANDORA_AGENT_RELEASE (stable/beta). BETA may prompt for confirmation.
  8. Create temp workspace $HOME/pandora_deploy_tmp.
  9. Install dependencies (skipped if PANDORA_SKIP_DEPENDENCIES=1). Dependencies vary by agent type:
    • GO: perl tar (+ procps on Debian).
    • PERL: perl perl-Sys-Syslog unzip tar (+ RHEL: libnsl/libxcrypt, SUSE: none, Debian: procps).
    • PERL_SOURCES: full set including perl-Scalar-List-Utils, perl-IO-Socket-SSL,
      perl-Digest-MD5, perl-threads, perl-Thread-Semaphore,
      libnsl (RHEL); perl-YAML-Tiny,
      perl-IO-Socket-SSL, libnsl3 (SUSE); libsys-syslog-perl,
      libyaml-tiny-perl, libio-socket-ssl-perl, libscalar-list-utils-perl (Debian).
  10. Download the tarball with curl.
  11. Validate the tarball (structural + fingerprint).
  12. Install via install_tarball:
    tar xvzf + cd unix && ./pandora_agent_installer –install.
  13. Configure /etc/pandora/pandora_agent.conf with the PANDORA_* variables.
  14. Docker/systemd compatibility: if systemctl status fails, copy pandora_agent_daemon to /etc/init.d/ and restart it there.
  15. Restart pandora_agent_daemon and verify the process is running (up to 5 retries, 1s apart).
  16. Clean up $HOME/pandora_deploy_tmp.
  17. Print green success message.

Logs

All command output goes to /tmp/pandora-agent-deploy-YYYY-MM-DD.log. On failure the script prints the log path.

Examples

GO agent, stable, with agent name and group

export PANDORA_SERVER_IP='10.0.0.1' \
       PANDORA_AGENT_PACKAGE=GO \
       PANDORA_AGENT_NAME='web-01' \
       PANDORA_GROUP='Web'
curl -sSL https://pfms.me/agent-deploy | bash

Perl agent from source, beta, automated

export PANDORA_SERVER_IP='10.0.0.1' \
       PANDORA_AGENT_PACKAGE=PERL_SOURCES \
       PANDORA_AGENT_RELEASE=BETA \
       PANDORA_SKIP_CONFIRMATION=1
curl -sSL https://pfms.me/agent-deploy | bash

Direct URL (custom build), automated

export PANDORA_SERVER_IP='10.0.0.1' \
 PANDORA_AGENT_PACKAGE=\
'https://ci.internal/builds/pandorafms_one_agent_linux-999.go.tar.gz' \
 PANDORA_SKIP_CONFIRMATION=1 \
curl -sSL https://pfms.me/agent-deploy | bash

RHEL without subscription check

export PANDORA_SERVER_IP='10.0.0.1' \
       RHEL_CHECK_SUBSCRIPTION=0
curl -sSL https://pfms.me/agent-deploy | bash

SUSE / OpenSUSE (GO agent)

export PANDORA_SERVER_IP='10.0.0.1' \
       PANDORA_AGENT_PACKAGE=GO
curl -sSL https://pfms.me/agent-deploy | bash

Skip dependency installation (pre-installed system)

export PANDORA_SERVER_IP='10.0.0.1' \
       PANDORA_SKIP_DEPENDENCIES=1
curl -sSL https://pfms.me/agent-deploy | bash

Supported OS matrix

OS Versions Package manager Notes
RHEL / CentOS / Rocky / Alma 7 yum
RHEL / CentOS / Rocky / Alma 8 dnf + libnsl for PERL
RHEL / Rocky / Alma 9 dnf + libnsl libxcrypt-compat for PERL
RHEL / Rocky / Alma 10 dnf + libnsl libxcrypt-compat for PERL
SUSE / OpenSUSE Tumbleweed / Leap zypper No extra perl subpackages (all in perl). libnsl3 for PERL_SOURCES.
Debian / Ubuntu 22.04+ apt + procps for all types.

Test results

Results below are from containerized tests using the BETA channel (PANDORA_AGENT_RELEASE=BETA).

Canonical OS (fully supported)

OS GO PERL PERL_SOURCES
Rocky Linux 8 🆗 🆗 🆗
Rocky Linux 9 🆗 🆗 🆗
Rocky Linux 10 🆗 🆗 🆗
Ubuntu 22.04 🆗 🆗 🆗
Ubuntu 24.04 🆗 🆗 🆗
Ubuntu 26.04 🆗 🆗 🆗
openSUSE
Tumbleweed 		🆗 fail installed,
won't start —
libnsl.so.1 not present
on SUSE (binary needs it) 		🆗

Additional tested OS

OS GO PERL PERL_SOURCES
Debian 12 🆗 🆗 🆗
Debian 13 🆗 🆗 🆗
Fedora 43 🆗 fail needs
libnsl + libxcrypt-compat
(not installed by default) 		🆗
AlmaLinux 9 🆗 🆗 🆗
AlmaLinux 10 🆗 🆗 🆗
CentOS Stream 9 🆗 🆗 🆗
CentOS Stream 10 🆗 🆗 🆗

Pipeline notes

  • BETA channel requires PANDORA_SKIP_CONFIRMATION=1 in non-TTY environments (containers, CICD).
  • PANDORA_SKIP_DEPENDENCIES=1 skips OS package installation. Use it only when dependencies are already present — both the script and the GO agent's pandora_agent_installer need perl and tar.
  • Oracle Linux is not supported because perl is absent from its base repositories. Enabling ol8_codeready_builder or EPEL may resolve it but is outside the script's scope.
  • Alpine Linux lacks bash and uses busybox ash, which does not support the bash syntax used by the script.

←Back to Pandora FMS documentation index