AgentSight is a zero-instrumentation AI Agent observability tool based on eBPF. It captures LLM API calls, Token consumption, and process behavior at the kernel level without modifying Agent code.
AgentSight provides full-stack observability for AI Agents running on Linux:
| Capability | Description |
|---|---|
| Token consumption analysis | Multi-dimensional Token accounting by agent, task, and model |
| Behavior audit | Complete tracing of LLM calls and process execution |
| Dashboard visualization | Web UI for real-time Token trends, Agent health, and session traces |
| Agent auto-discovery | Automatic detection of running AI Agent processes |
| Interruption detection | Detection of LLM errors, SSE truncation, context overflow, and crashes |
| External log export | Supports exporting structured events to external log services |
| Requirement | Minimum |
|---|---|
| OS | Linux |
| Kernel | >= 5.8 (BTF support required) |
| Privileges | root or CAP_BPF (for eBPF probes) |
| ANOLISA raw package | Linux x86_64, system mode |
macOS: On macOS, AgentSight provides two commands —trace
(trajectory collector that scans local JSONL session files, no eBPF) andserve
(Dashboard viewer). All other eBPF-dependent commands are Linux-only.
Install the published component with the ANOLISA CLI:
sudo anolisa install agentsight
sudo yum install agentsight
cd src/agentsight && make build-all
Use
make build-all
for source builds: it builds the Dashboard frontend, the main binary, andagentsight-enforcer
in sequence. Running onlymake build
skips the enforcer, andserve
will keep loggingAgentSight enforcement unavailable
.
Use the systemd unit for a normal deployment. It runs eBPF tracing and the Dashboard together and starts the enforcer dependency in the required order:
sudo systemctl enable --now agentsight.service
sudo systemctl status agentsight.service
Open http://localhost:7396
after the service becomes active. Enabling the main unit also keeps AgentSight available after a reboot.
The bundled systemd launcher binds the Dashboard to 0.0.0.0
. Restrict port 7396 with a firewall or security group before exposing the host to an untrusted network.
The service runs as root with a private umask and stores data under
/var/log/sysak/.agentsight
. Use sudo
for CLI queries and Dashboard access commands that read this service-owned data.
For foreground troubleshooting, stop the systemd unit first so it does not
compete with a second tracer. Then use two terminals and run both commands as
root. The second command is not reached if both are entered sequentially
because agentsight trace
stays in the foreground:
sudo systemctl stop agentsight.service
sudo agentsight trace
sudo agentsight serve
sudo agentsight dashboard --no-open
Localhost access is authentication-free; remote access requires a token, see
[Dashboard Access & Authentication].
Starts kernel-level capture of AI Agent activity.
sudo agentsight trace
Requires root privileges. Captures SSL/TLS traffic, process events, and file operations. Run
sudo systemctl stop agentsight.service
before starting a foreground tracer.
sudo agentsight serve
sudo agentsight serve --host 0.0.0.0 --port 7396
Run serve
as the same user that runs trace
so both commands resolve the
same data directory. Binding to 0.0.0.0
exposes the Dashboard on every interface; restrict network access before using that form.
Dashboard token authentication is enabled by default:
Localhost access(loopback) bypasses authentication — just openhttp://127.0.0.1:7396
.Remote access requires a token: append?token=<TOKEN>
to the browser URL, or set theAuthorization: Bearer <TOKEN>
HTTP header.- The token is auto-generated on the first
serve
startup (64 hex characters) and persisted to the.dashboard_token
file next to the database (default/var/log/sysak/.agentsight/.dashboard_token
); it is reused across restarts. - Run
sudo agentsight dashboard --no-open
to print the service-owned access URL and token, then open the URL as your desktop user.
To disable authentication (only recommended on trusted internal networks), set in the config file:
{
"server": { "auth": { "enabled": false } }
}
After editing /etc/agentsight/config.json
, run sudo systemctl reload agentsight.service
to apply the change — no restart
needed.
GET /api/docs
returns the full API route inventory (method, path, description) so scripts and integrations can discover endpoints; requests to unknown /api/
paths also point to it in the 404 response.
curl http://127.0.0.1:7396/api/docs
Displays the Dashboard URL and auth token, then tries to open a browser. On ECS instances it also prints a security-group configuration guide.
sudo agentsight dashboard --no-open
Rolls up sessions and Token usage, interruption events grouped by severity, and Tokenless savings for a recent time window — one command for the overall health picture.
agentsight summary
agentsight summary --last 168 --json
Data sources degrade independently: a missing database contributes zeros without affecting the rest of the report.
sudo agentsight token
sudo agentsight token --period week --compare
sudo agentsight token --json
agentsight audit
agentsight audit --pid 12345 --type llm
agentsight audit --summary
agentsight discover
agentsight discover --list-known
Query and manage AI Agent session interruption events.
Interruption types:
| Type | Description | Default Severity |
|---|---|---|
llm_error |
||
| HTTP status >= 400 or SSE body contains error | high | |
sse_truncated |
||
SSE stream ended without finish_reason=stop |
||
| high | ||
context_overflow |
||
| Context length exceeded | high | |
agent_crash |
||
| Agent process disappeared mid-session | critical | |
token_limit |
||
finish_reason=length with output near max |
||
| medium |
agentsight interruption list [--last <HOURS>] [--type <TYPE>] [--severity <LEVEL>]
agentsight interruption stats
agentsight interruption count
agentsight interruption get <ID>
agentsight interruption session <SESSION_ID>
agentsight interruption conversation <CONVERSATION_ID>
agentsight interruption resolve <ID>
Configuration file: /etc/agentsight/config.json
(override with --config
).
Important: User config filesreplace(not extend) the built-in default rules. Ensure your config includes all Agent rules you need.
| Feature | JSON Path | Default | Description |
|---|---|---|---|
| Token stats | features.token_stats |
||
true |
|||
| Core Token accounting | |||
| SQLite storage | features.sqlite_storage.enabled |
||
true |
|||
| Local persistence | |||
| Interruption detection | features.interruption_detection.enabled |
||
true |
|||
| Error/crash detection | |||
| Audit | features.audit |
||
true |
|||
| LLM call audit | |||
| Session mapping | features.session_mapping.enabled |
||
true |
|||
| responseId→sessionId |
| Config | Default | Description |
|---|---|---|
event_channel_capacity |
||
| 10,000 | Probe event bounded channel capacity | |
pending_genai_max_count |
||
| 1,000 | Max events awaiting session_id | |
max_connection_body_mb |
||
| 8 | Single HTTP connection body buffer limit | |
ring_buffer_mb |
||
| 32 | eBPF Ring Buffer size (must be power of 2) |
AgentSight provides a built-in conversational skill for Copilot Shell. Users can query Token usage and audit logs via natural language:
- "How much Token did I use today?"
- "Show me today's LLM call records"
AgentSight integrates with the Tokenless component to display Token savings data in the Dashboard. No additional configuration needed — if both are installed, savings data appears automatically.
Default maximum database size: 200 MB. When reached, automatic cleanup triggers.
Customize via environment variable:
export AGENTSIGHT_GENAI_DB_MAX_SIZE_MB=500
rm -rf /var/log/sysak/.agentsight
Q: Why can't I see Token data for OpenClaw?
A: AgentSight monitors the openclaw-gateway
daemon. Check client-gateway connectivity. If you see "pairing required" errors, run openclaw devices approve
.
Q: Why does the Token savings page show 0?
A: Possible causes: (1) The AK/SK authentication mode is not yet supported; (2) Session ID format is non-standard UUID.
Q: Why do cumulative savings exceed the single-call difference?
A: Agents include historical messages in context. Savings accumulate across turns, so cumulative savings exceed per-turn differences.