To install a new Outpost agent, you first generate an enrollment token in Portail ZAPP, then run the proposed installation command on the machine. The agent presents itself with this token, which can only be used once. The installation packages uploaded to Portail ZAPP are used both for installation and for updates.
The screens are reserved for the Administrators group. Open them from the Outpost menu (Outposts, Packages and Enrollment tokens entries).
Generating an enrollment token
On the Outposts page, click Generate an enrollment token and fill in:
- Hostname (optional): if filled in, only an agent reporting exactly this name can use the token (letters, digits, dots, hyphens and underscores). On Linux, the generated command sets this name for the agent. On Windows, it must be the computer name (
%COMPUTERNAME%), as the page reminds you; - Machine ID (optional): same principle, with the machine's hardware identifier;
- Validity duration (minutes): between 1 and 1,440 minutes (24 h), 60 by default;
- Installation parameters (optional): the agent's logging settings, remembered for the whole instance and reused in the commands generated at the next step. Left on Agent default, they are omitted from the commands:
| Parameter | Values | Agent default |
|---|---|---|
| LogSinks | file: log files in the log folder; native: Windows Event Log, or the system journal (journald) on Linux; both: both | both |
| LogLevel | Trace, Debug, Information, Warning, Error, Critical, from most detailed to most restricted | Information |
| Log folder (Windows) | an absolute path (drive letter, or network share \\server\share\…) the service account can write to, with no quotes, backticks or dollar signs; only used with file or both |
the logs subfolder of the agent's folder in %ProgramData% |
| Log folder (Linux) | an absolute path starting with / the service account can write to, with no backslashes, quotes, apostrophes, backticks or dollar signs; only used with file or both |
/var/log/webbase-outpost |
A level changed later from the agent's page takes precedence over LogLevel, including after a restart. The Windows folder is only used in the Windows command, the Linux folder only in the Linux configuration file. A refused value is flagged field by field and no token is generated. If the instance's public address is not configured, the commands contain https://<App:BaseUrl>: replace it with the server's address.
Click Generate. The Enrollment token generated page shows the token and its expiry date: "Copy this token now." It will never be shown again after leaving this page, because it is never stored in clear text. The Copy button puts it on the clipboard.
The Installation command section gives, ready to copy:
- Windows (MSI): downloading the package from your instance, then the silent installation, to run in an administrator PowerShell (the token is passed through a temporary file, deleted once read);
- Linux (.deb): downloading the package (the command fails if no package is available), the commands that create the configuration file
/etc/webbase-outpost/outpost.env, readable by root only, then the installation.
If the agent is refused at enrollment, the server response gives the reason: token expired, already used, revoked, or a machine name different from the one bound to the token. In that last case, the application log shows the name the agent reported.
The download uses the token itself: it only works while the token is valid, and only if a current package exists for the platform. Finally click I have copied the token. Once installed, the agent appears in the Outposts list.
Enrollment tokens
The Enrollment tokens page (button of the same name on the Outposts list) lists the generated tokens: status, machine it is Bound to (or Not bound), creation, expiry and use dates, author. A token is Valid, Consumed (already used by an agent), Expired or Revoked. Revoke (for a valid token) prevents it from being used again.
Installation packages
The Outpost installation packages page lists the uploaded packages: platform, version, file, size, date and status: Current (the version being distributed), Available (never activated: it is waiting for you to activate it) or Archived (it was the current version and no longer is). The most recent come first; the list can be sorted, filtered and paged.
- Upload a package: choose the File, enter its Version and a Platform pattern (for example "Debian GNU/Linux 13"). This text is compared, ignoring case, with the operating system reported by each agent's inventory to choose the right package;
- Activate makes a package the current version for its platform pattern: the previous current version becomes Archived. Deactivate (on the current version) removes that status without activating another one: nothing is distributed for this platform any more (automatic update, manual update, install commands) until the next activation. Delete removes a package, after confirmation.
Public release site: when the site address is set in the configuration (Outpost:Packages:FeedUrl), Portail ZAPP checks the latest published agent version every hour and adds it to the packages, with the origin Public site. The release signature and each file's size and fingerprint are verified: a non-compliant file is never added. By default, the new version is added without being activated, with the Available status: click Activate to distribute it (or set Outpost:Packages:FeedAutoActivate to true). A deleted version is never imported again, and a version older than the current one is ignored. The Public release site box shows the last check and its result; Check now runs it again. After several failures in a row, an alert appears in event management.
Automatic auto-update: when Enabled, Portail ZAPP sends the current version to every active agent that connects with another version. A periodic check (every 5 minutes by default) also catches agents that stay connected. When Disabled, an agent is only updated if you click Force-send current version on its page.