IT Operations Management (ITOM)

When do you go for agent-based and when do you go for agent-less monitoring?

When do you go for agent-based and when do you go for agent-less monitoring?

Ramkumar Devana

I have a visual puzzle in the latter half of this article, do try it.



When do you go for agent-based and when do you go for agent-less monitoring? Don’t get stuck thinking that only one of these approaches – agentless- or agent-based monitoring is going to be useful. It is always a question of what level of monitoring you want, depending on cost,budgets, time, and network speeds.


Agentless monitoring is easy to deploy, as the monitoring and configuration happens at a central place in a nice (admin) UI of course. Costs of installation (and the ongoing maintenance) are really low.


Monitoring with agents has the cost of installation, configuration (proportionate to number of managed elements), platform support needs and dependencies. You also need to worry about patching.


Tip: Make the agent software as part of your standard OS image template to reduce the work in first-time installation. A lot of HP enterprise customers follow this best practice already saving time thereby.


So on a first level, we can immediately say on a cost/effort basis, agentless comes out on top.


Next the whole paradigm of end-point monitoring (testing response time and throughput across a data link), is built with a remote probing/agentless mechanism in mind. An agent (in the general sense of the term), is not used and would not be suitable in this respect.


And then, there are other points of how being agentless brings about broader (and sometimes, easier) platform support including for devices such as UPS and printers.


So why and when would somebody go for agent-based monitoring?


Have you heard them say ‘No pains, no Gains’?


  • It is always a trade-off with monitoring: In many cases, it is not enough to do a 5-minute remote polling, especially with a huge reliance on network connectivity to do the monitoring. What if there was a temporary problem during the 5-minute period lasting outside of the monitoring runs – something people call a brownout?


  • What if there was a problem that went entirely unnoticed, but it has a cycle of repetition that is analyzed only by reading fine-grained (real-time) performance data for the system? The data that agent’s continuous data collection provides would be helpful to analyse some of these ‘seasonal’ problems.


  • There are crucial systems that support SLA’s for 99.999%  (5-nines) availability. It is important to assess to the level of the minute and second, how the system is performing – the peaks and trough of usage, not just average utilization levels. This is crucial for capacity analysis and prediction heuristics (I like that term – prediction heuristics!!!). While it is theoretically possible to poll at shorter intervals than a minute, it is not efficient to go to really low intervals using remote polling approach (as minor delays due to network latency can cause havoc with the data collections).


  • Sometimes it is not possible to get the data remotely owing to lack of vendor interfaces to access application, or system data.


  • In general, agent-based monitoring is regarded more secure since it does not necessitate storage of passwords centrally. Organizations that have high-level of security compliance needs would prefer agent-based monitoring as a result.



Joe and Jane


Here’s Joe and Jane – both of these engineers are in-charge of monitoring a set of systems in their company X, Inc. Take a look at their differing needs and POVs.




After reading what Joe and Jane are looking for you will have a decision to make.  Or will you? It is possible to get the best of both worlds and perform a balancing act. You can use both approaches to their advantages.


X-Inc uses agent-based and agentless (remote) approaches to monitor their IT landscape. Another case of this combined monitoring is within a cloud environment, where monitoring gets done via (cloud) vendor APIs but the guest OS still remains the blackbox.


To know what is happening within the guest OS some agent-style instrumentation is required. This might be the forwarder like the Splunk UF or a low-footprint software that can do 'close' monitoring by collecting data at low levels of granularity. Here's a picture that you would find useful.






Visual puzzle


Here's an exercise for you: here are a couple of tag clouds showing monitoring-related terms. Which do you think refers to agent-based monitoring and which is agent-less monitoring?   Let me know what you think in the comments section below.  Let’s see if you get it right –If you get it right, I know my tag clouds are well done :).


For knowing more about tag clouds go to




Tag clouds above created using


I am amazed with the power of info-graphics and I would like to conclude this post with a nice infographic - a visual to help you decide whether to go agentless or use agent software for monitoring. You can save this as a poster if you like. Just ensure that you retain the copyright info.




Here is a e-book from HP on balancing agent-based with agentless monitoring –




Here are some links to products in the HP Software portfolio that offer capabilities for agentless and agent-based monitoring.


- HP SiteScope software

- HP Operations Smart Plug-ins

- HP Virtualization Performance Viewer

HPE Software Rocks!
  • infrastructure management
About the Author

Ramkumar Devana

Ramkumar Devanathan (twitter: @rdevanathan) is Product Manager for HPE Cloud Optimizer (formerly vPV). He was previously a member of the IOM-Customer Assist Team (CAT) providing technical assistance to HP Software pre-sales and support teams with Operations Management products including vPV, SHO, VISPI. He has experience of more than 14 years in this product line, working in various roles ranging from developer to product architect.


What I'd like to see is a management platform that lets me set consistent policies, regardless of if agentless or agent-based monitoring is used.


E.g. I could set a disk space policy for a node, and the management server would be intelligent enough to know if that node has an agent installed or not, and would then use whatever monitoring method made sense. Then if I later tried to assign a policy that needed an agent, the system would be intelligent enough to deploy an agent. But if the policy needed to be agentless (e.g. remote monitoring if a port was open), then it would automatically be done in an agentless manner.


I'd like to do this all from one console, with consistent terminology and interface. Not the mishmash of Operations Manager + SiteScope, but one consolidated tool that takes the best of both products. I'd also like this to be consistently licensed too, so customers could seamlessly switch between agents and agentless, depending on the requirement.


I'd also like the agents to be stable, which HP Operations Agent have not been. Using the latest publicly available versions + patches of OMW, NNMI and Operations Agent, the opctrapi process keeps restarting. This is using the latest versions, using the HP recommended integration method. That's a big reason why people don't like agents - they're just not stable, and then rolling out updates is a real pain.


Oh and agent-based is the wordcloud on the left.

Acclaimed Contributor.

Hi Lindsay, thank you for the valuable comments/guidance. This helps set the context of this blog post - my focus has been on the monitoring approach itself - which approach to use, and when both approaches become useful.


Yes with the suggestions you have provided, configuration complexity will be reduced and this is useful feedback to pass on to the product engineering team (which I have done already). Watch this space for updates in this respect.


Looking forward to further discussions with you, and hopefully we can get to meet soon :)


- Ramkumar Devanathan