Verifying connection

After any deploy, three signals confirm the agent is healthy end to end. Check them in this order.

Signal 1 - container or task is RUNNING

Path	How to check
Cloud (managed) Fargate	`aws ecs describe-services --cluster argus-agent-<stack> --services argus-agent-<stack>` (expect `runningCount=1`)
Cloud (managed) EC2	`aws cloudformation describe-stacks --stack-name argus-agent-ec2 --query 'Stacks[0].StackStatus'` (expect `CREATE_COMPLETE`; the stack uses `cfn-signal`, so this means UserData finished and the agent container started)
Cloud (DIY) Terraform	`terraform output cluster_name` then `aws ecs describe-services`
Cloud (DIY) ECS task JSON	`aws ecs describe-tasks --cluster <cluster> --tasks <task-id> --query 'tasks[0].lastStatus'` (expect `RUNNING`)
Local Compose	`docker compose ps` (expect `Up ... (healthy)`)
Local docker run	`docker ps --filter name=argus-agent`

If the container is not RUNNING, jump to Troubleshooting. If it is RUNNING, continue to signal 2.

Signal 2 - agent logs show bootstrap and auth

Every path produces the same sequence on first boot:

secure_credential_manager - No role ARN provided, using instance credentials
   (Cloud paths)
   OR
secure_credential_manager - Role ARN provided, will assume role arn:aws:iam::...
   (Local paths)

Bootstrapping via enrollment token (pool=baseline)...
   (Bootstrap mode only)

Bootstrap succeeded - API key persisted for restart-safe auth.
Starting Argus Agent...
Connecting to https://api.argusdspm.com...
Authenticated as '<your-agent-name>' (agent_xxx)
Polling for jobs (capacity=4)...

How to read these logs:

Path	How to read
Cloud (managed) Fargate, Cloud (DIY)	`aws logs tail /ecs/argus-agent/<stack-or-customer-name> --follow`
Cloud (managed) EC2	`aws ssm start-session --target i-xxxxxxxxxxxxxxxxx`, then `docker logs argus-agent`
Local Compose	`docker compose logs -f argus-agent`
Local docker run	`docker logs -f argus-agent`

If logs stop at the Bootstrapping... line, the backend is unreachable or the token is invalid. See Troubleshooting.

Signal 3 - dashboard sees the agent

In the Argus dashboard:

Agents page: a row for your agent with last_seen updating every 10-30 seconds and a green health dot.
Cloud accounts page: the cloud account record shows agent_online: true and is_connected: true after the first successful scan job (which can take a few minutes if there are no pending jobs in the tenant).

If signal 2 is green but the dashboard does not see the agent, the agent is reaching the wrong backend URL (check ARGUS_BACKEND_URL).