Trmm Expert

Overview

Tactical RMM (TRMM) is an open-source remote monitoring and management platform built on Django, Vue.js, and Go, with MeshCentral providing remote desktop/terminal/file browser capabilities. It uses NATS for real-time agent communication and PostgreSQL for data storage.

This skill provides expert-level answers from the complete TRMM documentation. When a user asks about TRMM, read the relevant reference file(s) listed in the navigation table below, then answer using that content.

Domain Concept Map

Organizational hierarchy: Client > Site > Agent. Every agent belongs to exactly one site, and every site belongs to exactly one client.

Check types: Disk Space, CPU Load, Memory, Script Check, Event Log, Ping, Windows Service (Winsvc). Each check runs at a configurable interval and produces a pass/fail result with a severity level (Info, Warning, Error).

Alert flow: Check fails or agent goes overdue → Alert created with severity → Alert Template determines notification actions (email, SMS, dashboard popup, webhook) → Optional failure script runs → When resolved, optional resolved script runs.

Task and Collector flow: Automated Tasks run scripts on schedules (time-based, check-failure, or manual). A Collector Task saves its last stdout line to a Custom Field, enabling dynamic data collection.

Custom Fields are user-defined fields on Agent, Site, or Client objects. They are referenced in scripts as {{agent.FieldName}}, {{site.FieldName}}, or {{client.FieldName}}. The Global Key Store provides {{global.key_name}} variables available to all scripts.

Automation Policy inheritance: Global → Client → Site → Agent. Each level can block inheritance from the level above. Policies deploy Checks, Tasks, Patch Policies, and Alert Templates in bulk. An Enforced policy overwrites conflicting agent-level checks.

Script variable syntax: {{model.field}} — e.g., {{agent.hostname}}, {{agent.site.name}}, {{client.name}}. Nested relations work. Everything between {{ }} is case-sensitive.

Reference Navigation

Read the reference file(s) matching the user's question topic before answering.

Cross-Reference Guide

Some questions span multiple domains. Load files in the order shown:

Key Syntax Quick Reference

Agent variables (use in script arguments or env vars):

• {{agent.hostname}}, {{agent.public_ip}}, {{agent.local_ips}}
• {{agent.operating_system}}, {{agent.plat}}, {{agent.version}}
• {{agent.site.name}}, {{agent.site.client.name}}
• {{agent.logged_in_username}}, {{agent.needs_reboot}}

Custom fields (case-sensitive, spaces allowed):

• {{agent.My Field Name}}, {{client.AV_KEY}}, {{site.no_patching}}

Global keystore: {{global.key_name}}

Alert template variables (only in failure/resolve actions):

• {{alert.message}}, {{alert.severity}}, {{alert.alert_type}}
• {{alert.agent.hostname}}, {{alert.site.name}}, {{alert.client.name}}
• {{alert.get_result.stdout}}, {{alert.get_result.stderr}}

Reporting data queries (YAML in variables editor):

data_sources:
    agents:
        model: agent
        filter:
            site__client_id: '{{ client.id }}'
        columns:
            - hostname
            - operating_system
            - last_seen

Jinja loops in reports:

{% for item in data_sources.agents %}
{{ item.hostname }} - {{ item.operating_system }}
{% endfor %}

Searching Large References

For reporting.md (~1200 lines), use Grep to find specific topics:

• Data query filters: search for filter: or model:
• Jinja syntax: search for {% or {{
• Specific models: search for the model name (e.g., model: agent)

For settings-and-admin.md (~700 lines), search by section:

• Email setup: search for Email or SMTP
• Permissions: search for Role or Permission
• Management commands: search for the command name or python manage.py

For architecture.md (~1100 lines):

• Services: search for systemctl or the service name (e.g., nats, celery)
• Agent install: search for install or deployment

Important Caveats

• Case sensitivity: Everything between {{ }} in script variables is case-sensitive. {{agent.Hostname}} will NOT work; use {{agent.hostname}}.
• API trailing slashes: All TRMM API endpoints require a trailing slash (e.g., /agents/). Omitting it returns a redirect or error.
• Enterprise features: Reporting and SSO are Enterprise Edition features requiring a sponsor license.
• RunAsUser limitations: The RunAsUser option for scripts and tasks has limitations on Linux/macOS agents.
• MeshCentral domain: MeshCentral must be accessible on the same domain or with valid TLS. Agent communication depends on mesh connectivity.
• Check intervals vs task schedules: Checks run at regular intervals (default 120s). Tasks use cron-style schedules, check-failure triggers, or manual execution. Don't confuse the two.
• Backslash escaping: In custom fields, \ is an escape character. Use \\ for literal backslashes.
• Policy inheritance blocking: Each level (Client, Site, Agent) can independently block policy inheritance from above. An "Enforced" policy overrides agent-level settings regardless.