01
Collector health you can plan with
Collector groups show membership, health, capacity and reserve, so source resilience is an operational decision you can inspect — not a surprise at 2 a.m.
Collect
Collectors that hold data through outages and licence limits.
Agents and collectors ship over HTTPS with a durable on-disk spool, and the agent updates itself only with signed packages. Logs no parser recognises go to the Parser Factory, which learns their shape and adds it to kymeer's shared parser for that device type once it passes a quality check.
How it works
Data that is held, not dropped.
- Agent for Windows, macOS and Linux; network collector for UDP and TCP syslog.
- Formats detected per line: syslog (RFC 3164 and 5424), JSON, CEF, LEEF, key=value.
- If a licence limit is reached, data waits in the spool — it is not discarded.
- Parser Factory groups logs that did not parse by device type and shape. A shape goes live only if at least 95% of the fields on every sample line are mapped; otherwise it stays a draft that parses nothing.
02
Updates only when they are signed
The agent installs an update only if its Ed25519 signature verifies and its SHA-256 checksum matches. Anything else is refused.
Specifications
| Agent | Windows · macOS · Linux |
|---|---|
| Collector | UDP/TCP syslog |
| Transport | HTTPS with durable spool |
| Agent updates | Signed (Ed25519 + SHA-256) |
| Formats | Syslog 3164/5424 · JSON · CEF · LEEF · key=value |
| Parser Factory | Adds learned shapes to one shared parser per device type, live only after a quality check; no log lines or tenant identities in any parser |