> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/getting-started/installing-collector/collector-overview.md).

# Collector overview

Nexthink Collector is a lightweight agent based on patented technology. It captures and reports network connections, program executions, web requests, and many other activities and properties from employee devices on which it runs. It is implemented as a kernel driver and accompanying services, offering remote and automated silent installations with negligible impact on system performance while minimizing network traffic.

| CPU usage                              | Typical memory usage                                                                                                                                                                 | Network traffic                                                                    |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------- |
| <p>Less than 0.15%<br>(on average)</p> | <ul><li>11-12KB non-paged kernel memory</li><li>1.1-1.4MB paged kernel memory</li><li>44-52MB user space memory<br>(temporary memory spikes are possible during campaigns)</li></ul> | <p>\~ 3kbps on average<br>(dependent on campaigns, remote actions and updates)</p> |

## Collector components <a href="#collectoroverview-collectorcomponents" id="collectoroverview-collectorcomponents"></a>

The capability of Collector for gathering user activity data is shared by the kernel driver and the helper service (or daemon) components ([list of the components](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/getting-started/installing-collector/collector-overview.md)). Running as a kernel driver close to the operating system allows reporting information only visible at this level.

## Features <a href="#collectoroverview-features" id="collectoroverview-features"></a>

#### Multiplatform <a href="#collectoroverview-multiplatform" id="collectoroverview-multiplatform"></a>

Collector is available for both Windows and macOS operating systems. A lightweight version of Collector optimized for desktop virtualization use cases is also available for thin clients powered by IGEL OS.

### CrashGuard <a href="#collectoroverview-crashguard" id="collectoroverview-crashguard"></a>

Since the Windows driver is a kernel-mode component, any error in its internals or its interaction with a misbehaving third-party driver can lead to system instabilities. Even with Nexthink striving as hard as possible to deliver bug-free software, the principle of precaution holds. The CrashGuard feature available for Windows platforms detects every system crash and, by default, disables the Collector driver if the system crashes more than five times in a row after installation. Refer to [Installing Collector on Windows documentation](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/getting-started/installing-collector/installing-collector-on-windows.md) for more information.

### Kernel-mode traffic interception <a href="#collectoroverview-kernel-modetrafficinterception" id="collectoroverview-kernel-modetrafficinterception"></a>

Some Windows applications may send and receive data to and from the network using kernel-mode components, actually hiding their network traffic from user-space monitoring applications. Being a kernel driver itself, Collector is nevertheless able to detect and report such traffic.

### Paths aliasing <a href="#collectoroverview-pathsaliasing" id="collectoroverview-pathsaliasing"></a>

Collector identifies commonly used paths and other special mount locations with path aliases. For example, when you assign drive letter D to the DVD-ROM, Collector reports an application executed from that media as `%RemovableDrive%\application.exe`.

### Reliable connectivity <a href="#collectoroverview-reliableconnectivity" id="collectoroverview-reliableconnectivity"></a>

Nexthink Collector relies on the connection-oriented features of the Transmission Control Protocol (TCP) to ensure that the information reaches the data processing layer.

In addition, when the connection between Collector and the Nexthink instance is lost or not yet established, Collector is able to buffer up to 15 minutes of data (a maximum of 2500 packets not older than 15 minutes) to send at a later time, once the connection is successful.

### Network switching <a href="#collectoroverview-networkswitching" id="collectoroverview-networkswitching"></a>

A change of the network interface is transparent, except when it invalidates the DNS resolution of the Nexthink instance. In that case, the process of adjusting to a different network may take a few minutes and Collector resends the whole context.

### Event logging <a href="#collectoroverview-eventlogging" id="collectoroverview-eventlogging"></a>

The appropriate system logs of the operating system record details regarding when and how Collector connects to the Nexthink instance and any potential errors.

### On-the-fly configuration <a href="#collectoroverview-on-the-flyconfiguration" id="collectoroverview-on-the-flyconfiguration"></a>

Applying changes to the configuration or updating Collector does not require a restart of the operating system. Changes take effect without interrupting the employee’s work.

## Code signed software <a href="#collectoroverview-codesignedsoftware" id="collectoroverview-codesignedsoftware"></a>

To be able to load and run on Windows devices, the kernel components of Collector for Windows are signed with an official Microsoft certificate. User-space components are signed with a valid Nexthink certificate.

Collector for macOS is signed with the Developer ID certificate of Nexthink and follows the Apple notarization process to ensure that it can be installed and run seamlessly on macOS devices.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.nexthink.com/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/getting-started/installing-collector/collector-overview.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.