BE HUBMonitor VyOS with an agent that reports to one console.
VyOS 1.3, 1.4 and rolling builds. Installed under /config so it survives an image upgrade, with the config-change time and the booted image on every heartbeat. BE AI investigates when something fails; a person approves the fix.
install
One line, from the company's install page.
Run in the router's shell, as a user who can write to /config. It fetches the signed binary, verifies the checksum, installs the service and connects. Run it again any time; it never overwrites the machine's identity.
curl -fsSL https://hub.[yourdomain]/install/inst_…/vyos.sh | sudo bash
Outbound 443 to the hub only. No inbound rule, no VPN, no SNMP community.
what the agent watches on VyOS
Survives an image upgradeVyOS upgrades by booting a whole new image, and anything outside /config goes with the old one. The agent installs to /config/be-agent and its service is re-created at every boot from the VyOS boot hook, so the router does not silently stop reporting after an upgrade.
Who changed the router, and whenThe heartbeat carries the time config.boot last changed and its size. The question actually asked about a firewall, answered without anyone logging in.
Which image is bootedThe image this boot is running from, read from the mount table rather than a kernel parameter, so an upgrade that did not take is visible.
Reports as VyOSNot as Debian. The fleet shows the VyOS release, so 1.3 and 1.4 are told apart at a glance.
Everything a Linux box getsServices and failed units, the journal, CPU, memory, every filesystem, ping and network facts, custom checks, alerts and the nightly BE AI pass.
Read-only collectionThe VyOS facts are file reads. No vbash, no operational-mode commands, nothing executed on a router carrying live traffic.
questions
Before you put it on VyOS.
Does it survive add system image?
Yes, and that is the reason for the separate install line. A normal Linux install works perfectly and then disappears at the next image upgrade, which is exactly when nobody is watching. Re-running the install line is safe: the boot-hook block is fenced with markers and replaced, never stacked.
What does it cost the router?
About 15 MB of memory and a fraction of a percent of CPU, measured on a 256 MB ARM router. Logs are capped at two files of 5 MB, rotated as they are written rather than at start-up, because a router can stay up for a year.
Put BE Hub on ten machines this week.
A pilot takes an afternoon: one install link, your own approvals, your own data. Uninstall the agent and you are out.