Skip to main content
One agent process per host, not per service. It attaches probes, aggregates in userspace, and exports OTLP to your aiAxonIQ endpoint. There is no sidecar, no proxy in your request path, and nothing loaded into your application processes.
Availability. The zero-code agent is an early-access distribution. It is installable, upgradable and tested, and it is not yet an integrated part of the product: there is no dashboard page for it, no in-product installer and no self-service download. Ask your account contact for access.Its telemetry, once flowing, is ordinary OTLP and needs nothing special — it appears in Services, Traces and Metrics exactly like SDK telemetry does. That is the design rather than a shortcut.

​
The shape

1

One agent per host

A systemd service on a VM, a container with host PID access under Docker, or a DaemonSet pod on Kubernetes. Same binary in each case.
2

It discovers processes

It scans for processes that serve or make network calls and attaches probes to the ones it can instrument. New processes are picked up as they start — nothing needs restarting when you deploy.
3

Probes write to kernel maps

Bounded work at the event, results into shared memory. See How eBPF works.
4

Userspace aggregates and decorates

Requests are assembled into spans and RED metrics, URL paths reduced to route patterns, and Kubernetes or host metadata attached.
5

It exports OTLP over TLS

To exactly one destination: your endpoint, authenticated with your license key. From there it is ordinary telemetry — see Platform architecture.

​
Why one process sees everything

Because it is in the kernel, the agent does not need to be inside your application. It needs to be in the same PID namespace as the processes it observes — which is what hostPID: true on Kubernetes and --pid=host under Docker are for.
Without host PID access, the agent sees only itself. It starts normally, reports healthy, discovers one process — its own — and produces essentially nothing.This is the most common installation mistake, and it looks identical to “the agent is broken”. If your service inventory did not grow after installing, check this before anything else. See Troubleshooting.
The same principle explains something people find surprising: the workload’s base image is irrelevant. A container has no kernel of its own, so a distroless image, a musl-based image and a full distribution image are all equally observable. The requirements apply to the host.

​
What it does before exporting

Three transformations happen on the host, and each exists for a reason worth knowing:
/orders/8817 and /orders/8818 are reduced to a single route shape.Two effects, and both matter. Cardinality: raw paths would turn one endpoint into a series per identifier, which is the fastest known way to make a metrics store unusable. Privacy: identifiers embedded in paths never leave the host.
Highest frequency, lowest diagnostic value, and frequently a large share of total volume. Dropping them at the source costs you nothing you would have looked at and reduces both your ingest bill and your rate-limit pressure.
A DaemonSet across 200 nodes is 200 exporters spending one organization’s rate-limit budget. Batching is tuned with that in mind rather than left at a single-process default. See Plan limits.

​
Deployment shapes

​
What it reads from Kubernetes

On Kubernetes the agent decorates telemetry with pod, namespace, node and workload. That needs cluster access, and the grant is deliberately small:
  • list and watch on pods, services, nodes and replicasets.
  • Read-only, cluster-scoped.
  • Used solely to attach metadata to telemetry — nothing is created, modified or deleted.
The rendered DaemonSet also sets privileged: false, drops all capabilities and then adds back exactly the profile’s set, and mounts the root filesystem read-only. You can inspect the whole thing before installing anything — see Kubernetes.

​
Where the credential lives

Never in a configuration file. On Kubernetes it is a Secret injected as an environment variable — never in the ConfigMap, so inspecting the ConfigMap stays a safe debugging step. On Linux it is a root-owned environment file with mode 0600. It is redacted in every diagnostic the tooling prints.
Issue the agent its own license key, scoped to traces and metrics, and revocable independently of your primary ingest key. A DaemonSet places the credential on every node, which is a materially wider exposure than one application’s configuration. See Security model.

​
Network requirements

Exactly one outbound destination — your OTLP endpoint, over TLS. The agent opens no inbound listeners and contacts nothing else: no analytics, no update check, no vendor telemetry. An egress-restricted network needs that one host allowed. The exception is install time, when upstream artefacts are downloaded and checksum-verified. See OpenTelemetry OBI.

​
Next

Security model

The full statement for a security review.

Capability profiles

Choosing a privilege level.

Install on Kubernetes

The Helm chart, values and what it renders.