Vector · Agent
The network collector that lives next to your devices
Light, portable and quick to set up: the Vector Agent is one Go program for Linux or Windows. It reaches your local devices over SSH, and sends the results back to Vector over TLS, connecting out by default. In the optional bidirectional mode, which runs through the Vector Hub over VPN, MPLS or private WAN, users can also log in to end devices through the agent with Vector Access. It collects configuration, not performance metrics.
- Outbound TLS by default
- Optional bidirectional mode
- Vector Access
What is a network collector?
A network collector is a lightweight service placed inside a network segment that reaches local devices on behalf of a central platform and reports back. The rConfig Vector Agent is a collector for configuration: it backs up device configurations, runs checks and commands, and sends the results to Vector over TLS, connecting out by default.
Not another monitoring agent
Network monitoring probe
Polls devices for performance and availability, so you know if something is up and how it is doing.
Network monitoring agent
Often installed on a host. It reports on that host to a monitoring platform.
- You are here
Vector Agent
A configuration collector. It backs up, checks and runs commands on network devices, and reports configuration back to Vector.
| Capability | Vector Agent | Direct SSH from core | RANCID / Oxidized | Vendor collector proxy | Custom cron scripts |
|---|---|---|---|---|---|
| Outbound TLS by default | Yes | No | No | Partial | No |
| Per-site credential isolation | Yes | No | No | Partial | No |
| Durable local queue | Yes | No | No | Partial | No |
| Dynamic worker scaling | Yes | No | No | No | No |
| SSH, including legacy interactive shells | Yes | Yes | PartialSSH only | PartialVaries | PartialVaries |
| Interactive shell SSH quirks (Avaya, HP, Cisco) | Yes | Partial | Partial | Partial | No |
| Windows supported | Yes | No | No | Partial | Yes |
| Structured, size bounded log sync | Yes | No | No | Partial | No |
| Commercial support available | Yes | No | No | Yes | No |
When one collector is enough
If you have one small network, one central collector is fine. If your network has many parts or many sites, or you look after many customers, put an agent in each one. Then you do not have to keep opening firewall rules.
Get the job, do it, send it back
Get a job
The agent asks the Vector Server for work on a set timer. With the optional bidirectional mode, the Vector Server can also start a job straight away.
Do the job at the site
It runs the job on the local devices over SSH, inside the segment. With the optional bidirectional mode, a user can also log in to a device through the agent with Vector Access.
Send back the result
Results and logs go back to the Vector Server over TLS. By default, the agent starts that connection. With the optional bidirectional mode, the Vector Server can also collect a config in real time, on demand.
Recover if something fails
If the agent stops, a watchdog restarts it. Unfinished work replays from the local queue.
Nothing stays on site
No copy of your data is kept at the customer site. Once the results are sent to Vector, the agent deletes them. Device credentials are held in memory only. So the agent is ephemeral.
Put it where your devices are
Customer sites
Place an agent inside each customer's network. It reaches the devices locally and connects out to Vector.
Branches and POPs
Run an agent at the edge, so backups do not have to cross the wide network.
Regional data centres
One agent can look after a whole region. It can also take over heavy polling groups from a central server.
Network zones behind firewalls
Put an agent inside a protected zone. By default it only needs to connect out.
Operational zones
Run an agent at a remote or industrial site, like a satellite link or a utility plant. It works right next to the devices, so slow or far-away links matter less.
Safe by design, one agent for each customer
Outbound by default
The agent connects out over TLS with an agent key, so by default you do not need to open inbound ports. Bidirectional mode is optional and needs VPN, MPLS or private WAN.
Credentials held in memory only
Device credentials are delivered per job over TLS and held in memory only. Nothing is stored at rest on the agent.
One agent for each customer
In an MSP set-up there is one agent for each customer, keyed to one rConfig server.
Install in three steps
Install the agent
Install the agent on a Linux or Windows host at the site.
Register it with Vector
Make an agent key in rConfig and add it to the agent, so it can connect to your Vector Server.
Assign it to a customer
Tag devices with the agent that should poll them, and assign the agent to its customer.
Vector Agent 2.0
- Cold-start memory
- 18 MBLinux, idle worker pool
- Steady-state memory
- 62 MB8 workers × 25 jobs/min
- Binary size
- 14 MBlinux/amd64, stripped
- Avg SSH fetch
- 241 msCisco IOS show run
- Queue recovery
- < 2 safter agent restart
Measured on a 4 vCPU / 4 GB Linux collector, 8 workers, 25 jobs/min sustained. Each figure is measured under the condition shown, not a universal constant.
Where the agent fits
rConfig Vector
The back office. The Vector Server the agent reports to, for customers, policies, jobs and compliance.
Learn more about rConfig VectorVector architecture
Agents in every customer network, one Vector Server, outbound by default or bidirectional through the Vector Hub.
Learn more about Vector architecture
Vector Prism
The front office. The white label client portal your customers log in to.
Learn more about Vector Prism
Self-Hosted,
Inside Your Perimeter
No SaaS dependency
Every layer runs on infrastructure you control. rConfig has no access to your data unless you grant it.
Encrypted in transit
Agent to server over TLS. Server to Central Manager over AMQP with TLS.
Customer separation
Each customer has its own inventory, jobs and audit history, with hierarchical RBAC across your NOC and scoped access for customers.
Built for resilience
Central tiers support active or warm-standby HA pairs. If an agent stops, a watchdog restarts it and unfinished work replays from the local queue.
rConfig Vector Agent FAQ
What is the rConfig Vector Agent?
The rConfig Vector Agent is a lightweight Go binary that runs as a systemd or Windows service at each site, customer or network segment you need to manage. It connects to local network devices over SSH, and syncs configurations and logs back to a central rConfig server over TLS. By default, the agent connects out to the server.
Is the Vector Agent a network monitoring probe or agent?
No. A network monitoring probe polls devices for performance and availability, and a network monitoring agent usually reports metrics from a host. The Vector Agent is a configuration collector: it backs up, checks and runs commands against network devices and reports configuration back to Vector, not performance metrics. It is designed to sit alongside the monitoring you already run.
Which platforms and protocols does it support?
Linux and Windows. It speaks SSH, including interactive-shell support for legacy devices.
How does the agent work with restrictive firewalls?
By default, the agent only makes outbound TLS connections to the Vector Server. It pulls jobs, pushes results and streams logs on that channel, so you do not need inbound firewall rules. Bidirectional mode is optional. It runs through the Vector Hub and needs a routed path into the customer network, such as VPN, MPLS or private WAN. It adds real-time backups, live interrogation and Vector Access. Opening inbound firewall rules instead is possible, but we do not recommend it.
What happens if the agent or the network goes down?
Jobs and logs persist in a local queue, so nothing is lost. On restart, the agent replays unfinished work. If the rConfig API is unreachable, the agent keeps collecting and queues results locally until it can connect again.
Collect configs at every site, segment and customer
The Vector Agent is one Go program that runs as a systemd or Windows service. Put it anywhere your devices are, and let rConfig do the rest.