# Understanding Collector You must install an endpoint agent on all devices you want to connect to the Nexthink platform and allow the collection of relevant metrics. The following sections explain the features of endpoint agents in detail. See the [](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector "mention") documentation to learn which endpoint agent applies to your infrastructure scale and type, and how to configure and deploy it. ## VDI Client Extension The Nexthink VDI Client Extension is a lightweight agent for endpoint devices connected to virtual desktop environments (VDIs). The extension sends only relevant data to the Nexthink instance from devices on which Nexthink Collector cannot be installed. The Nexthink VDI Client Extension only sends relevant data while the device is connected to a VDI environment with Nexthink Collector running on it. No data is collected or sent when you are not connected or connected to a VDI environment without a Nexthink Collector running on it. Any necessary configuration is done on the connector that is installed on the VM. The connector communicates all configuration changes to the extension that is running on the client device. See the [vdi-experience-faq](https://docs.nexthink.com/platform/user-guide/vdi-experience/vdi-experience-faq "mention") to find answers to common questions regarding VDI, for example, deployment scenarios. ### Metrics collected by the VDI Client Extension The VM might expose some client information, such as `client device name`, `local ip`, `client app version`, and `client platform`. Installing the VDI Client Extension improves the reliability and accessibility of these fields. Furthermore, the extension provides the following performance metrics: * `network bytes/s in/out` * `network packets in/out` * `network errors in/out` * `normalized cpu usage` * `wifi signal strength` * `wifi transmission rate` * `wired link speed` * `wan latency` — This metric is available if a ping server is specified for the Collector running in the VM. ## Nexthink Collector Nexthink Collector is a lightweight agent based on patented technology that gathers hardware, software and activity data from the devices within your organization. It captures and reports network connections, program executions, installations, and many other activities and properties from employee devices on which it runs. Collector also enables employee engagement through feedback retrieval, as well as remotely acting on the device when required. It is implemented as a kernel driver and accompanying services, offering remote and automated silent installations with negligible impact on system performance while minimizing network traffic. See the following pages to learn how to deploy Collector to all corporate devices that run a supported version of the following operating systems: * [installing-collector-on-windows](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-windows "mention") * [installing-collector-on-macos](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-macos "mention") Once deployed and connected, the cloud platform applies the default auto-update policy. The system updates those devices categorized as `pilot` as soon as a new version is available. After two weeks, the system automatically pushes the update to all devices. To change the automatic update period, contact [Nexthink Support](https://support.nexthink.com/) and choose a period ranging from 1 to 8 weeks. On this page, you will find the following descriptions: * [#collectoroverview-features](#collectoroverview-features "mention") * [#componentsofcollector-windowscollector](#componentsofcollector-windowscollector "mention") * [#componentsofcollector-maccollector](#componentsofcollector-maccollector "mention") {% hint style="info" %} The [Nexthink VDI Client Extension](#download-the-extension) is included as a component in Nexthink Collector, therefore you do not need to install it separately on company-managed devices accessing virtual environments. For **company-managed devices**, see the [installing-collector-on-windows](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-windows "mention") documentation to learn how to install Collector. {% endhint %} ### Collector features #### Multiplatform Collector is available for both Windows and macOS operating systems. #### CrashGuard Since the Windows driver is a kernel-mode component, any error in its internals or its interaction with a misbehaving third-party driver can lead to system instabilities. Even with Nexthink striving as hard as possible to deliver bug-free software, the principle of precaution holds. The CrashGuard feature available for Windows platforms detects every system crash and, by default, disables the Collector driver if the system crashes more than five times in a row after installation. Refer to [Installing Collector on Windows documentation](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-windows) for more information. #### Kernel-mode traffic interception Some Windows applications may send and receive data to and from the network using kernel-mode components, actually hiding their network traffic from user-space monitoring applications. Being a kernel driver itself, Collector is nevertheless able to detect and report such traffic. #### Paths aliasing Collector identifies commonly used paths and other special mount locations with path aliases. For example, when you assign drive letter D to the DVD-ROM, Collector reports an application executed from that media as `%RemovableDrive%\application.exe`. #### Reliable connectivity Nexthink Collector relies on the connection-oriented features of TCP to ensure that the information reaches the data processing layer. In addition, when the connection between Collector and the Nexthink instance is lost or not yet established, Collector is able to buffer up to 15 minutes of data (a maximum of 2500 packets not older than 15 minutes) to send at a later time, once the connection is successful. #### Network switching A change of the network interface is transparent, except when it invalidates the DNS resolution of the Nexthink instance. In that case, the process of adjusting to a different network may take a few minutes and Collector resends the whole context. #### Event logging The appropriate system logs of the operating system record details regarding when and how Collector connects to the Nexthink instance and any potential errors. #### On-the-fly configuration Applying changes to the configuration or updating Collector does not require a restart of the operating system. Changes take effect without interrupting the employee’s work. #### Code signed software To load and run Nexthink Collector on Windows devices, kernel components are signed with an official Microsoft certificate. User-space components are also signed with a valid Nexthink certificate. To run Nexthink Collector on macOS devices, the macOS Collector is signed with Nexthink's Developer ID certificate and follows the Apple notarization process. #### Collector components The capability of Collector for gathering user activity data is shared by the kernel driver and the helper service (or daemon) components. Running as a kernel driver close to the operating system allows reporting information only visible at this level. Nexthink Collector comprises a set of services and libraries that gather information about the devices in your corporate network and their activity. Collector sends all the gathered information to a Nexthink instance, where the system processes and stores it. Additional Collector components deal with the features provided by optional Nexthink products. Other components help you with the installation and configuration process. Find in this document the description of all the different components and the filesystem paths where to find them on the devices after installation. This article details as well the registry keys and the additional files created or modified during installation. ### Windows Collector components The Windows version of Collector includes the following set of components: #### Windows Collector binaries For all versions of Windows, the system installs the following components: * **Main driver**: A kernel mode driver that gathers valuable information from employee devices * **Network specific driver**: A kernel mode driver that detects network connections * **Helper service**: A Windows service that complements the main driver by collecting additional information * **Printing info library**: A dynamic link library that is responsible for detecting printing activity * **Automatic updates**: A component of Collector that is responsible for downloading new versions and updating the installed components * **Coordinator**: Coordinator is responsible for establishing and maintaining a network connection with the Nexthink instance. Other components share that connection for the purpose of communication with the instance. * **Nexthink Engage**: Components for presenting campaign questions and getting answers from employees * **Nexthink Act**: Components that manage the execution of remote actions * **Nexthink Reporter** (deprecated): A troubleshooting tool that creates debug reports for specific support cases * **Nexthink Event Log Provider**: A component for logging events in the Windows Event Log * **Nexthink Application Experience**: A component for monitoring business applications * **VDI Client Extension** : A component that sends VDI-specific data to the Nexthink instance * **Command line configuration tool** (optional): A [tool to configure ](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/windows-collector-references/collector-configuration-tool-for-windows)Collector from the command line
ComponentFilePath
Helper service for automated updatesnxtcssu.exe%ProgramFiles%/Nexthink/Collector/Coordinator/
Main drivernxtrdrv.sys%Windows%\System32\drivers
Network specific drivernxtrdrv5.sys%Windows%\System32\drivers
Helper servicenxtsvc.exe%ProgramFiles%\Nexthink\Collector\Collector
Printing info helper librarynxtdll.dll%ProgramFiles%\Nexthink\Collector\Collector
Nexthink Event Log Providernxteventprovider.dll%ProgramFiles%\Nexthink\Collector\Collector
Immersive appsnxtwrt.dll%ProgramFiles%\Nexthink\Collector\Collector
Application start timenxtwpm.dll%ProgramFiles%\Nexthink\Collector\Collector
Coordinator servicenxtcoordinator.exe%ProgramFiles%\Nexthink\Collector\Coordinator
Campaigns coordinatornxteufb.exe%ProgramFiles%\Nexthink\Collector\Coordinator
Remote actions coordinatornxtcod.exe%ProgramFiles%\Nexthink\Collector\Coordinator
Updates coordinatornxtupdater.exe%ProgramFiles%\Nexthink\Collector\Coordinator
OpenSSL
  • libcrypto-1_1-x64.dll
  • libssl-1_1-x64.dll
%ProgramFiles%\Nexthink\Collector\Coordinator
Campaigns
  • nxtray.exe
  • nxtray.exe.config
%ProgramFiles%\Nexthink\Collector\Engage
Remote actions
  • Google.Protobuf.dll
  • nxtcampaignaction.dll
  • nxtremoteactions.dll
%ProgramFiles%\Nexthink\Collector\RemoteActions
Reporter (deprecated)nxtreporter.exe%ProgramFiles%\Nexthink\Collector\Reporter
VDI Client Extension
  • nxtdvc64.dll
  • nxtdvc32.dll (for Citrix)
%ProgramFiles%\Nexthink\Collector\Plugins
Web application monitoringnxtbsm.exe%ProgramFiles%\Nexthink\Collector\BSM
nxthostapp.exe%ProgramFiles%\Nexthink\Collector\BSM\hostapp\
Command line
configuration tool		nxtcfg.exe%Windows%\System32
#### Registry keys During installation, Collector creates the following keys in the Registry of Windows: ``` HKEY_CLASSES_ROOT\nxtrayproto HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AppStartTime HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\DN HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\RebootMarker HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\RemoteActions HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\Nexthink Collector HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator\params HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator\Modules\COD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator\Modules\EndUserFeedback HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator\Modules\Updater HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Nexthink Service HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Nexthink Service\runtime_stats HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nxtrdrv HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nxtrdrv\params HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nxtrdrv5 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nxtrdrv5\Parameters\Wdf HKEY_LOCAL_MACHINE\SYSTEM\Nexthink\Updater HKEY_USERS\S-1-5-21-[X-X-X-X]\SOFTWARE\NEXThink\NxTray ``` #### Additional files Find the Collector log files here: * `%windir%\nxtsvc.log` * `%windir%\nxtsvc.1.log` * `%windir%\nxtsvc.2.log` * `%windir%\nxtupdater.log` * `%windir%\nxtupdater.1.log` * `%windir%\nxtupdater.2.log` * `%windir%\nxtcoordinator.log` * `%windir%\nxtcoordinator.1.log` * `%windir%\nxtcoordinator.2.log` * `%windir%\nxteufb.log` * `%windir%\nxteufb.1.log` * `%windir%\nxteufb.2.log` * `%windir%\nxtcod.log` * `%windir%\nxtcod.1.log` * `%windir%\nxtcod.2.log` * `%temp%\nxtray.log` * `%temp%\nxtray.log.` Finally, Windows creates a cached copy of the kernel drivers in two folders whose names start with the name of the drivers (`nxtrdrv` and `nxtrdrv5`, respectively) followed by a unique identifier that depends on the version of the driver itself. Find the folders here: * `%windir%\System32\DRVSTORE` The Nexthink Reporter tool creates its logs and reports here: * `%temp%\nxtreporter[reportID].log` * `%temp%\nxtreport-[hostname]-[reportID].zip` ### macOS Collector The macOS version of Collector includes the following set of components. #### Files * **Main service**\ A macOS daemon that gathers valuable information from employee devices * **Coordination service**\ A macOS daemon that synchronizes with the appliances to provide services such as automatic updates, employee engagement and execution of remote actions in the near future * **Application monitoring**\ A macOS daemon that is in charge of gathering specific data for business applications
ComponentFilePath
Main service, device level data acquisitionnxtsvc/Library/Application Support/Nexthink
User level data acquisitionnxtusm/Library/Application Support/Nexthink
Coordination servicenxtcoordinator/Library/Application Support/Nexthink
Campaigns
  • nxteufb
  • nxtray.app
/Library/Application Support/Nexthink
Automatic Updatesnxtupdater/Library/Application Support/Nexthink
Remote Actions
  • nxtcod.app
  • nxtraoutput
/Library/Application Support/Nexthink
Web Application monitoringnxtbsm/Library/Application Support/Nexthink
Web Application monitoringnxthostapp/Library/Application Support/Nexthink
#### Additional files | Component | File | Path | | ------------------ | ----------- | --------------------------------------- | | Configuration file | config.json | `/Library/Application Support/Nexthink` | In the *config.json* file, find the exact version of the installed Collector and the [status of the TCP connection](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/managing-collector-agents/querying-the-collector-tcp-connection-status#queryingthecollectortcpconnectionstatus-mac-collector). `Find the log files here:` * `/Library/Logs/nxtsvcgen.log` * `/Library/Logs/nxtsvcgen.log` * `/Library/Logs/nxtcoordinator.log` * `/Library/Logs/nxtbsm.log` * `/Library/Logs/nxtcod.log` * `/Library/Logs/nxtcsi.log` * `/Library/Logs/nxteufb.log` * `/Library/Logs/nxtextension.log` * `/Library/Logs/nxtupdater.log` `Also under each user folder:` * `/Users/{username}/Library/Logs/nxthostapp.{userSID}.log` * `/Users/{username}/Library/Logs/nxtray.{userSID}.log` * `/Users/{username}/Library/Logs/nxtusm.{userSID}.log` `Multiple options can be selected.`