Why are agents getting disconnected?

Duplicate MAC addresses

The Sysdig agent will use the eth0 MAC address to identify the different hosts within your infrastructure. In a virtualized environment, you should confirm each of your VM's eth0 MAC addresses are unique.

If a unique address cannot be configured, you can supply an additional parameter in the Sysdig agent's dragent.yaml configuration file:  machine_id_prefix: prefix

The prefix text can be any string and will be prepended to the MAC address as reported in the Sysdig Monitor web interface's Explore tables.

Here is an example Docker run command installing the parameter via the ADDITIONAL_CONF feature:

docker run --name sysdig-agent --privileged --net host --pid host -e ACCESS_KEY=abc123-1234-abcd-4321-abc123def456 -e TAGS=tag1:value1 -e ADDITIONAL_CONF="machine_id_prefix: MyPrefix123-" -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro sysdig/agent

The resulting /opt/draios/etc/dragent.yaml config file would look like this:

tags: tag1:value1 machine_id_prefix: MyPrefix123-

You will then see all of your hosts provided all the prefixes are unique.  The prefix will be visible whenever the MAC address is displayed in any view.


Conflicting MAC addresses in GKE environments

In Google Container Engine (GKE) environments, MAC addresses could be repeated across multiple hosts. This would cause some hosts running Sysdig agents not to appear in your web interface. To address this, add a unique machine id prefix to each config you use to deploy the agent as a Daemon Set to a given cluster (i.e. each sysdig-daemonset.yaml file).

value: "machine_id_prefix: mycluster1-prefix-"


Have more questions? Submit a request