Diagnostics

This article brings together the diagnostic resources for both Kabeen agents: the user agent, deployed on endpoints, and the server agent, deployed on the infrastructure.

User agent

The user agent writes its activity to local log files. These files are the primary diagnostic resource when unexpected behavior occurs.

Changing the logging level

The user agent runs with an INFO logging level by default. This setting can be adjusted via the Windows registry.

• Path: HKEY_CURRENT_USER\Software\Policies\Kabeen\Configuration
• Key name: LogLevel
• Accepted values: Error, Info, Debug

After editing the registry, restart the Kabeen agent so that the new level is applied.

Log file locations

Log files are stored in operating-system-specific locations. Logs are kept individually per user.

Server agent

The server agent is Kabeen's infrastructure agent for Windows, Linux and IBM i. It autonomously collects metrics and inventory information through an HTTPS channel authenticated with a tenant-bound API key. The server agent runs as a service and does not receive downstream commands from the platform.

Architecture and components

The agent is made of several modules:

• A main collection and coordination component
• A dedicated module for system metrics collection
• Configuration and authentication services
• A centralized logging system

Configuration and initialization

The server agent configuration covers the following items:

• The API key used to authenticate with the platform
• The organizational scope parameters (structure and team membership)
• The outbound connection parameters (proxy, etc.)

On Windows, some settings such as the log level are defined via registry keys.

Logging

The server agent logs are stored locally on the server. They are the first source of information for diagnostics.

The log location depends on the agent version. Version 3.0 (Kabeen Server Agent) writes to new locations, alongside those of the legacy agent (Kapsul).

Startup errors (Windows)

If the server agent fails to start on Windows, run the following checks:

1. API key: verify that the API key is correctly set in the config.toml file or in the registry.
2. Service state: check that the service is present and started.

sc query kapsul
Get-Service KabeenServerAgent

Use sc query kapsul for the legacy agent or Get-Service KabeenServerAgent for version 3.0.

3. Outbound connectivity: make sure the server can reach the Kabeen services over outbound HTTPS:
   • api.kabeen.io:443 (control / REST)
   • intake.kabeen.io:443 (ingestion / gRPC)