Agents and collectors

kymeer collects data with two programs: the agent, which runs on Windows, macOS and Linux endpoints, and the collector, which receives syslog from network and security devices over UDP and TCP. Both send data to kymeer over HTTPS only, from a durable spool on disk.

What does the agent collect?

• Log files named in the collection profile, picked up as they change, including across rotation and truncation.
• Software inventory on Linux and Windows. There is no inventory on macOS.
• Optional sensors, listed below. Every sensor is off until you turn it on, so upgrading an agent never starts new collection by itself.

Sensor	Platforms
DNS queries	Windows, macOS, Linux
Network connections	Windows, macOS, Linux
File integrity	Windows, Linux
Persistence (registry, scheduled tasks, removable media)	Windows
Windows Event Log	Windows
systemd journal	Linux
macOS unified log	macOS

What does the collector receive?

By default the collector listens for syslog on ports 514 and 5514, over both UDP and TCP. You can change the listeners. It does not parse anything locally: it spools each raw message and ships it, and kymeer detects the format on arrival. See Formats and the Parser Factory.

How are agents and collectors enrolled?

Each one enrols once with a one-time enrolment token. kymeer works out the tenant and source from the credential on the server; the agent never states its own tenant. Every server address must be HTTPS before any credential is sent.

What happens during an outage or at a licence limit?

• Data waits in the spool and is retried until kymeer acknowledges it.
• If a licence limit is reached, kymeer asks the agent to come back later. The data is held in the spool, not dropped.
• The spool has a size cap, 512 MiB by default. It never deletes unsent data to make room. When it is full, new data is refused until space is freed.
• Syslog over UDP has no back-pressure. If the collector cannot keep up, the operating system can drop datagrams; the collector logs when this happens. TCP does not have this limitation.

How are updates installed?

The agent can update itself. It installs a new version only if its SHA-256 checksum matches and its Ed25519 signature verifies against the release key. It respects a configured update window, checks its own health after the update and rolls back if that check fails. Self-update stays off until a release signing key is configured. The standalone collector does not update itself.

Does the agent look up internal hostnames?

Yes, by default. When a log line contains private IP addresses, the agent and the collector ask your site's own DNS for their hostnames and attach the results to the event. You can turn this off if you treat internal hostnames as sensitive.

What are collector groups?

Collector groups help you plan for collectors that fail. Each group shows its members, how many are healthy, the capacity you declare per collector and how many are held in reserve. kymeer then shows the capacity left if the reserve members are lost.