Skip to main content

Understanding the Agent Installation Files

Overview​

This article describes the files found in the Gen 7 NetCore agent's installation path and what each one is used for.

The current Gen 7 NetCore agent stores its working data in the following locations:

  • Windows: C:\ProgramData\NNT\gen7agent.app.netcore\
  • Linux: /var/nnt/gen7agent.app.netcore/

Agent Files​

agent.id — Contains the unique identifier assigned to the agent during its first registration with the Hub. If the agent is reinstalled or re-registered on the same device with a different ID, the Hub validates that the agent ID matches the stored device name; mismatches trigger a registration error — see Error: Hub Connection Failed (500 Server Message) to resolve it.

MasterDevice.json — Stores the agent's master device record, including the AgentID, DeviceID, device name, configuration date, and platform details. This is the agent's primary identity, and the Hub populates this file after the agent's first successful registration. The agent uses this file to send events and receive configuration updates.

ProxiedDevices.json — An array of devices currently proxied by this agent, in JSON format. This agent monitors devices that cannot run the agent directly. Each proxied device entry includes its AgentID, DeviceID, connection settings, and device-specific configuration.

Config-<DeviceID>.xml — The device's monitoring configuration file, where <DeviceID> is replaced with the actual device ID. This XML document controls which trackers the agent runs and what it monitors (files, registry, processes, services, database objects, etc.). The agent downloads this file from the Hub after registration. If this file is deleted but the agent's tracker store shows a recent configuration date, the agent automatically requests a fresh copy.

Store.db — SQLite database storing the agent's baseline information for all tracked items. Used to detect what has changed on the monitored system by comparing current state against this baseline. The agent automatically purges this file during major version upgrades.

Events.db — SQLite database where the agent temporarily buffers change events detected during tracking and compliance reporting before sending them to the Hub. The agent automatically purges sent events older than 7 days.

HubDetails.xml — The agent's Hub connection configuration, including the Hub URL, authentication credentials (username/password for on-prem mode), SSL certificate thumbprints, and optional proxy settings. Also contains device name prefix/suffix rules applied during registration.

Rolling-log.txt — Text log file generated by the agent. Contains diagnostic information including startup/shutdown events, polling cycles, errors, compliance report runs, configuration changes, and connectivity status. Useful for troubleshooting agent behavior and Hub communication issues. The agent manages the file size automatically.

Version.txt — Records the agent's current version number. Used internally to detect upgrades and trigger necessary data migrations.

Platform.json — Contains platform metadata (OS name, device name, IPv4 address) written during the agent's first run. Provides quick access to device platform information without making system calls.