Consider using

watch

to have it poll more often? You need to grab the logs while it's up and not crashlooped. You can also check journald for the system agent logs there as well.