Security Center:Install the Security Center agent

How it works

The agent runs the following workflow after installation:

1. Registration — The agent downloads automatically and registers with the Security Center service using a unique installation key.

2. Data collection — The agent collects processes, network connections, and logon behaviors in real time.

3. Data reporting — Collected data is sent to the service over a Transport Layer Security (TLS) encrypted channel. The agent adapts to proxy environments automatically.

4. Command execution — The agent receives and runs security commands from the service, such as vulnerability scans and baseline checks, and reports results.

5. Heartbeat — The agent sends periodic heartbeat signals so the console can display your servers' real-time protection status.

Prerequisites

Before you begin, confirm the following:

• Supported operating system — The target server runs a supported OS. See Supported operating systems.

• Account ownership — The server belongs to your current Alibaba Cloud account. Cross-account installation is not supported.

• Administrator or root permissions — You must run the installation command as an account with administrator (Windows) or root (Linux) permissions.

• No previous agent installed — If an older agent is present, uninstall it first and delete any remaining files from the installation directory:

  • Linux: /usr/local/aegis

  • Windows (32-bit): C:\Program Files\Alibaba\aegis

  • Windows (64-bit): C:\Program Files (x86)\Alibaba\aegis

To protect resources that belong to other Alibaba Cloud accounts, use the multi-account management feature.

Installation notes:

• Each server takes about 5 minutes to install.

• Installation does not require a server restart and does not interrupt running workloads.

• During high-payload tasks such as scans, CPU and memory usage of the agent may temporarily increase.

Check which servers need the agent:

1. Log on to the Security Center consoleSecurity Center consoleSecurity Center consoleSecurity Center consoleSecurity Center console.

2. In the left navigation pane, choose System Settings > Feature Settings. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

3. On the Agent > Agent Not Installed tab, view the list of servers without the agent.

Choose an installation method

One-click installation

Use this method if your ECS instance meets all of the following conditions:

• The instance is in the Running state and has the Cloud Assistant client installed.

  If Cloud Assistant is not installed, install it first. See Cloud Assistant.

• The network type is VPC.

• The instance is in one of the following regions:

  Category	Regions
  Asia-Pacific	China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Shenzhen), China (Hong Kong), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Japan (Tokyo)
  Europe and Americas	Germany (Frankfurt), UK (London), US (Silicon Valley), US (Virginia)
  Middle East and India	UAE (Dubai)

• Third-party security software is disabled or uninstalled.

  After the Security Center agent is installed, you can re-enable or reinstall third-party security software.

Steps:

1. Log on to the Security Center consoleSecurity Center consoleSecurity Center consoleSecurity Center consoleSecurity Center console.

2. In the left navigation pane, choose System Settings > Feature Settings. In the upper-left corner, select China or Outside China.

3. On the Agent > Agent Not Installed tab, find the target server and click Install Agent in the Actions column.

   To install the agent on multiple servers at once, select them and click Install.

General installation

Use this method for any server with internet access.

Steps:

1. Log on to the Security Center consoleSecurity Center consoleSecurity Center consoleSecurity Center consoleSecurity Center console.

2. In the left navigation pane, choose System Settings > Feature Settings. In the upper-left corner, select Chinese Mainland or Outside Chinese Mainland.

3. On the Agent > Installation Command tab, copy the installation command for your server's operating system. Choose one of the following command types: To create a custom installation command, click Create Installation Command and configure the following parameters:

   • Default installation command — Requires no extra configuration. Servers are assigned to the Ungrouped group. Use this for a quick setup when you don't need to assign the server to a specific group immediately.

   • Custom installation command — Lets you set the server group, command expiration time, and access method at install time. Use this to automate asset categorization during deployment.

   The command includes a unique installation key — the value after -k.

   Parameter	Description
   Expiration Time	The command expiration date. After this date, the command is invalid and the agent cannot be installed using it.
   Service Provider	The service provider (SP) of the server.
   Default Group	The server group to assign the server to. See Manage server groups.
   OS	The operating system of the target server.
   Create Image System	Select No for general installation.
   Access Method	Select Public Endpoint to communicate directly through the server's public IP address.

4. Log on to the server and run the installation command:

   • Windows — Run the command in Command Prompt (CMD) or PowerShell.

   • Linux — Run the command in the server's command-line interface.

Batch installation using an image

Use this method when you need to create servers at scale with the agent pre-installed. The process installs agent files on a template server without activating them, captures an image, and then uses that image to create new instances.

Step 1: Prepare the template server and generate the installation command

1. Prepare a clean server with no third-party security software installed.

2. Log on to the Security Center consoleSecurity Center consoleSecurity Center consoleSecurity Center consoleSecurity Center console.

3. In the left navigation pane, choose System Settings > Feature Settings. In the upper-left corner, select Chinese Mainland or Outside Chinese Mainland.

4. On the Agent > Installation Command tab, click Create Installation Command and set the following parameters:

   • Create Image System: Select Yes. This is the most critical step.

   • OS: Select the OS that matches your template server.

   • Other parameters (such as Default Group): Configure as needed.

Step 2: Run the installation command on the template server

1. Log on to the template server with administrator permissions.

2. Run the image installation command. The script downloads agent files to the installation directory but does not start any service processes.

3. After the script completes, immediately shut down the template server. Do not restart it.

Step 3: Create and use the image

1. Create a custom OS image from the powered-off template server. See Create a custom image.

2. Use the image to create new server instances. See Create an ECS instance from a custom image.

3. When each new instance starts for the first time, the agent automatically initializes, generates a unique agent ID, and connects to Security Center.

Installation in restricted or complex network environments

Use this method for servers without direct internet access. Security Center supports two access options:

• Access via proxy — For servers that cannot reach the internet directly.

• Access from outside the Chinese mainland over a third-party leased line: For scenarios where you connect to an Alibaba Cloud region over a third-party leased line and need to specify the region-specific domain name for Security Center.

• Access via a leased line (outside China) — For servers connecting to an Alibaba Cloud region over a non-Alibaba Cloud leased line.

Verify the installation

After installation, the system downloads the agent files and starts the required processes. Use one of the following methods to confirm the installation succeeded.

# Check core processes. All three must appear.
ps -ef | grep -E 'AliYunDun|YunDunMonitor|YunDunUpdate'

# Check service status. The status should be active (running).
systemctl status aegis

root        5472       1  0 Sep10 ?        00:00:18 /usr/local/aegis/aegis_update/AliYunDunUpdate
root        5524       1  0 Sep10 ?        00:01:34 /usr/local/aegis/aegis_client/aegis_12_61/AliYunDun
root        5546       1  0 Sep10 ?        00:03:13 /usr/local/aegis/aegis_client/aegis_12_61/AliYunDunMonitor

● aegis.service - LSB: Aegis service
   Loaded: loaded (/etc/rc.d/init.d/aegis; generated)
   Active: active (running) since Mon 2023-10-30 10:00:00 CST; 1 day 2h ago

telnet jsrv.aegis.aliyun.com 443
telnet jsrv2.aegis.aliyun.com 443
telnet jsrv3.aegis.aliyun.com 443
telnet update.aegis.aliyun.com 443
telnet update2.aegis.aliyun.com 443
telnet update3.aegis.aliyun.com 443

Trying 106.11.x.x...
Connected to jsrv.aegis.aliyun.com.
Escape character is '^]'.

Troubleshooting

Agent is offline

If the agent status shows Offline in the console, the agent cannot communicate with the Security Center service. Work through the following checks in order.

Check agent processes

Confirm that AliYunDun and AliYunDunUpdate are running.

• Linux: ps -ef | grep AliYunDun

• Windows: Open Task Manager and check the Details or Services tab.

If processes are not running, restart them manually:

Linux:

# Stop the processes.
killall AliYunDun
killall AliYunDunUpdate

# Start the latest version. In /usr/local/aegis/aegis_client, find the aegis_10_xx folder
# with the highest version number (for example, aegis_10_75 over aegis_10_73).
/usr/local/aegis/aegis_client/aegis_10_xx/AliYunDun

Windows:

In the Services panel, right-click Alibaba Security Aegis Detect Service and Alibaba Security Aegis Update Service and select Restart.

Check network connectivity

Confirm your firewall or security group allows outbound traffic to jsrv.aegis.aliyun.com and update.aegis.aliyun.com. If the server cannot reach these endpoints, the agent goes offline.

Fix DNS issues:

If DNS is not resolving correctly, restart the server or check whether the DNS service is healthy.

Fix firewall rules (iptables example):

# Allow access to the control service.
iptables -A OUTPUT -p tcp -d jsrv.aegis.aliyun.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -d jsrv.aegis.aliyun.com --dport 80 -j ACCEPT

# Allow access to the update service.
iptables -A OUTPUT -p tcp -d update.aegis.aliyun.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -d update.aegis.aliyun.com --dport 80 -j ACCEPT

If you use Alibaba Cloud Firewall, see Create an outbound access control policy.

Fix Alibaba Cloud security group rules:

Add outbound rules to allow traffic to the following CIDR blocks on ports 80 and 443. See Manage security groups for steps.

Allow outbound traffic for 100.100.0.0/16, 106.11.0.0/16, and 100.103.0.0/16. Example configuration for 100.100.0.0/16:

Direction: Outbound

Authorization policy: Allow

Protocol type: TCP

Port range: 80/443

Authorization object: 100.100.0.0/16

Check system resources

If the server has insufficient CPU, memory, or disk space, the agent cannot start.

• CPU/Memory: Use top (Linux) or Task Manager (Windows).

• Disk space: Use df -h (Linux) or check This PC (Windows).

If the AliYunDun process itself is consuming excessive resources, contact technical support and provide the relevant logs. If other business processes are the cause, optimize those applications or upgrade the server.

To free disk space, delete unnecessary files.

Check for duplicate agent IDs

This issue typically occurs when multiple server instances are created from the same image without generating a new installation command. The uuid field in the following configuration file will be identical across affected servers:

• Linux: /usr/local/aegis/aegis_client.conf

• Windows (32-bit): C:\Program Files\Alibaba\aegis\aegis_client.conf

• Windows (64-bit): C:\Program Files (x86)\Alibaba\aegis\aegis_client.conf

To fix this, uninstall the agent on the template server, delete remaining files, and generate a new installation command before creating additional images.

Check for software conflicts

Other HIDS, EDR, or antivirus software may conflict with the Security Center agent. Disable or uninstall conflicting software, then reinstall the agent.

Analyze agent logs

Check the agent logs for specific error messages:

• Linux: /usr/local/aegis/log/aegis.log

• Windows (32-bit): C:\Program Files\Alibaba\aegis\log\aegis.log

• Windows (64-bit): C:\Program Files (x86)\Alibaba\aegis\log\aegis.log

If you cannot resolve the error from the logs, contact technical support with the complete log files.

FAQ

What's next

• Manage server groups

• Security Center agent processes

• Uninstall the Security Center agentLog on to the Security Center console.Log on to the Security Center console.Log on to the Security Center console.

• Use the Agent Troubleshooting feature