Small enough that nobody asks you to turn it off.

The best monitoring agent is one nobody argues about. Every agent that needs a runtime installed, a sidecar per pod, or a percentage of a core that shows up in capacity planning eventually becomes a negotiation with whoever owns the budget.

This one is a single self-contained binary. No runtime to install, no sidecar, no daemon zoo, nothing extra to keep patched. On a machine under real production load it costs 0.4% of one CPU core and about 45 MB of memory.

It also survives the conditions where you most need it. Telemetry is written locally first and replayed in order when a link returns, so a network cut during an incident costs you latency rather than evidence. Releases are signed and each agent verifies a signature before replacing itself.