Agent message delivery fairness
Apparatus and methods are disclosed for generating, sending, and receiving messages in a networked environment using autonomous (or semi-autonomous) agents. In one example of the disclosed technology, a method of controlling message flow in a computer network comprising a plurality of agents, agent data consumers, and an agent message bridge configured to send messages by receiving a set of messages, at least some of the messages including a message type, queuing the set of messages in a spooler that includes an indication of the respective message type for each of the messages, receive an indication that sending some of the messages queued in the spooler should be delayed for one or more indicated message types, and sending at least one of the messages to a selected one or more of the agent data consumers, the sent messages not being of the indicated message types.
1. A system, comprising:
one or more agent data consumers;
one or more agent platform servers, each of the agent platform servers including an agent bridge, the agent bridge being configured to:
determine, based on a lag between previously received messages in a spool, an adjusted rate at which future messages are to be sent by one or more agents; and
send an advisory message to adjust a rate at which the future messages are sent by the one or more agents to be the adjusted rate; and
the one or more agents, the agents being configured to execute on computing hosts separate from the agent platform servers, the agents being further configured to, responsive to receiving the advisory message from the agent bridge, adjust the rate at which the future messages are sent to the agent bridge to be equal to the adjusted rate.
2. The system of claim 1 , further comprising an affinity service, the affinity service being configured to map each of the agents to a respective one of the data consumers.
3. The system of claim 1 , wherein the affinity service mapping is based at least in part on one or more of the following: a geographic location of one or more of the agents and/or the agent data consumers; topology of a network carrying communication between the agent data consumers, agent platform servers, and/or agent computing hosts; a functional role of one of the agents and/or one of the agent data consumers; a version of an agent; and/or a version of an agent data consumer.
4. The system of claim 1 , wherein the agent platform server includes at least one computer-readable storage medium storing computer-executable instructions, which when executed, cause the agent platform server to perform a method, the computer-executable instructions comprising:
instructions that cause the agent platform server to send a message to the one or more agents indicating a message type via a communication connection; and
instructions that cause the agent platform server to receive host data from at least one of the agents, wherein at least some of the received host data has been stored at the agent's respective computing host when the agent cannot send data via the communication connection.
5. A method, comprising:
with an agent bridge computer:
via a computer network, receiving messages from at least one agent executing on a host computer, the messages being generated in response to the agent detecting an event, change, or operation monitored by the agent on the host computer, the messages being sent to the agent bridge computer according to a predetermined rate;
determining, based on a lag between the received messages in a spool, an adjusted rate at which future messages are to be sent by one or more agents; and
via a computer network, sending an advisory message to the at least one agent executing on the host computer comprising the adjusted rate at which the agent will send messages to the agent bridge computer; the adjusted rate being different than the predetermined rate.
6. The method of claim 5 , further comprising, via the computer network, receiving additional messages from the at least one agent executing on the host computer, the additional messages being sent to the agent bridge computer according to the adjusted rate.
7. The method of claim 5 , wherein the event, change, or operation comprises at least one of: a file integrity monitoring operation, a change management operation, or a command output capture rule operation on the host.
8. The method of claim 5 , further comprising sending at least one of the received messages to an agent data consumer via a computer network.
9. The method of claim 5 , further comprising determining the adjusted rate to prioritize messages carrying Security Content Automation Protocol data over other types of messages.
10. The method of claim 5 , further comprising determining the adjusted rate based on a desired spool depth.
11. The method of claim 5 , further comprising temporarily storing at least one of the received messages in a queue at the agent platform server.