Installing Collector manually
Install Collector manually on macOS using the graphical wizard or the command line. Use this method for a small number of devices or when a deployment tool is not available. After installation, grant full disk access to the required components.
Installation
You can install Collector on macOS either by using the graphical installation wizard or from the command line.
Choose the installation method that best fits your deployment scenario:
To install Collector on macOS using the Wizard installation:
Double-click the provided disk image file to mount it into your filesystem and see its contents.
Double-click the package file Nexthink_Collector_<version>.pkg and the installer will start with the introduction.
Select Continue to proceed.
In the step Personalization, configure the Nexthink Appliance to which Collector will connect:
Name or IP address
The FQDN of your Nexthink instance.
Data over TCP
Select this option to send data over a TCP channel.
TCP port
443
UDP port
Do not select this when using the Nexthink cloud platform.
Configure the Collector proxy settings:
Select Automatic proxy for Collector to take its configuration from a proxy auto-configuration (PAC) file. In PAC address, type in the URL of the file that determines the proxy to use.
Select Manual proxy for Collector to use the following proxy settings:
Address
Type in the FQDN of the proxy.
Port
Type in the port number where the proxy is listening.
Configure the other settings of Collector:
Customer Key
Copy and paste the contents of the file that holds the Customer Key.
Root CA
Leave this field empty.
Collector tag (optional)
An integer number (0—2,147,483,647) that identifies a group of Collectors; used for defining entities in hierarchies.
Collector string tag (optional)
A label (max 2,048 characters) that identifies a group of Collectors; used for defining entities in hierarchies.
Assignment service (optional)
Select if you have activated rule-based assignment (classic).
Nexthink Engage (optional)
Select to activate Campaigns features on this device.
Execution policy of scripts included in remote actions (optional)
Select the behavior:
Disabled (default): Collector runs no remote action on the device.
Unrestricted: Collector runs any remote action on the device, regardless of the digital signature of its script.
Trusted publisher: Collector runs on the device only those remote actions with a shell script that is signed by an identified developer.
Trusted publisher or Nexthink: Collector runs on the device only those remote actions with a shell script that is signed either by Nexthink or by an identified developer.
Pinned: Collector runs on the device only remote actions with a shell script signed with a signature, whose leaf certificate thumbprint is allowed via the
cert_fingerprintsargument. Refer to Certificate pinning for more information.Pinned or Nexthink: Collector runs on the device only remote actions with a shell script signed either by Nexthink or signed with a signature, whose leaf certificate thumbprint is allowed via the
cert_fingerprintsargument. Refer to Certificate pinning for more information.
Certificate fingerprints: If you selected Pinned or Pinned or Nexthink in the previous step,
define an allow list of script signature thumbprints separated by a single , without spaces surrounding it. The script signature thumbprint must match the signature's leaf certificate thumbprint. Refer to Certificate pinning for more information.
Select Continue to proceed.
In the step Destination select, the installer program shows the local paths in the system where it is going to install the different components of Collector. Keep the default paths and select Continue.
The Installation Type step shows details of the installation process, including the amount of disk space that the program is going to use. Select Install to begin with the installation.
The installer shows the progress of the installation, and it finishes with a summary message. If the installation was successful, select Close the installer.
The command-line installation lets you install Collector when you have access only through the macOS shell, including remotely through an SSH connection.
Mount the image file by running the following command:
hdiutil mount Nexthink_Collector_<version>.dmgChange the directory containing the csi.app file.
For example, run the following command when using Collector version 22.6.2.10:
cd /Volumes/Nexthink_Collector_22.6.2.10\ OSX\ 10.15\ -\ 12/csi.app/Contents/MacOS/Run the installer:
sudo ./csiUse the following arguments:
address
mandatory
FQDN of your Nexthink instance.
port
mandatory
Do not select when using the Nexthink cloud platform.
tcp_port
mandatory
Port number; set to 443.
rootca
mandatory
Not required; leave empty.
key
mandatory
Path to your Customer Key file
engage
optional
Whether to enable Campaigns.
Default value: disable
data_over_tcp
optional
Whether to enable to send of all data over TCP.
Default value: enable
use_assignment
optional
Whether to enable rule-based assignment (classic).
Default value: disable
ra_execution_policy
optional
Whether to enable the remote actions. Values:
disabled(default): Collector runs no remote action on the device.unrestricted: Collector runs any remote action on the device, regardless of the digital signature of the associated script.signed_trusted: Collector runs on the device only remote actions with a shell script signed by an identified developer.signed_trusted_or_nexthink: Collector runs on the device only remote actions with a shell script signed either by Nexthink or an identified developer.signed_pinned: Collector runs on the device only remote actions with a shell script signed with a signature, whose leaf certificate thumbprint is allowed via thecert_fingerprintsargument. Refer to Certificate pinning for more information.signed_pinned_or_nexthink: Collector runs on the device only remote actions with a shell script signed either by Nexthink or signed with a signature, whose leaf certificate thumbprint is allowed via thecert_fingerprintsargument. Refer to Certificate pinning for more information.
tag
optional
Integer (0—2,147,483,647) to identify an individual or batch installation of Collectors.
string_tag
optional
Label (maximum 2,048 characters) to identify an individual or batch installation of Collectors.
proxy_pac_address
optional
URL of a PAC file for automatic proxy configuration.
proxy_address
optional
FQDN of a proxy for manual proxy configuration.
proxy_port
optional
Port number where a proxy is listening for manual settings.
Example
sudo ./csi -address <instance_address>
-tcp_port <instance_tcp_port>
-key <customer_key_file>
-engage enable
-proxy_pac_address <pac_URL>
-proxy_address <proxy_FQDN_or_IP> -proxy_port <port_number>
-tag 1000 -string_tag PreproductionFull disk access
Nexthink Collector relies on the Apple Endpoint Security framework and follows Apple privacy guidelines. Some Collector components need full disk access to collect complete data and run remote actions on devices.
The following Collector components need full disk access:
nxtsvc: Collects core device data and binary executions and connections events. Permission for this module is mandatory; required by Apple Endpoint Security and Apple privacy controls.nxtcod: Executes remote actions on user devices and sends results back to Nexthink. Permission for this module is optional; grant it only if remote actions need access to special folders or shared network resources.
Full disk access affects Collector differently depending on the version:
Collector version 26.5 or later runs in limited mode until you grant full disk access. It starts full data collection and can run remote actions only after you grant it.
Collector versions earlier than 26.5 cannot run without full disk access.
Granting full disk access
Install Collector first and then grant full disk access to the relevant components by following the steps below.
This procedure requires a user with administrator rights.
Select System Settings > Privacy & Security > Full Disk Access.
Select +, browse to /Library/Application Support/Nexthink/nxtsvc.app, and enable the toggle.
If you need to run remote actions on the device, select +, browse to /Library/Application Support/Nexthink/nxtcod.app, and enable the toggle.
Stop and relaunch Collector for the changes to take effect.
Last updated
Was this helpful?