About the LogicMonitor Collector
Overview
The LogicMonitor Collector is an application that runs on a Linux or Windows server within your infrastructure and uses standard monitoring protocols to intelligently monitor devices within your infrastructure.
LogicMonitor Collectors are not agents and do not have to be installed on every resource within your infrastructure that you would like monitored. Rather, you should install a Collector on a host in each location of your infrastructure. See Installing Collectors.
The Collector retrieves data from all the devices assigned to it, then encrypts the data and sends it back to the LogicMonitor servers over an outgoing SSL connection.
One Collector can typically monitor hundreds of devices; however, this capacity depends on how many metrics are being monitored for each device, as well as the available resources of the server on which the Collector is installed. For more information on capacity, see Collector Capacity.
How Collectors Determine What Metrics to Monitor for Devices
When you add a device into monitoring, LogicMonitor applies built-in intelligence to recognize what kind of device it is. Based on the information discovered about the device, LogicMonitor DataSources are applied.
DataSources are templates that tell the Collector how to monitor the device, what metrics to collect for the device, how to display those metrics as graphs, and what values indicate issues that need attention. LogicMonitor installs with hundreds of pre-built DataSources that will automatically apply when you add devices into your account.
Collector Data Storage
All of the data from your Collectors is consolidated in a LogicMonitor data center, and this data is accessible in your LogicMonitor portal from anywhere with an internet connection. This necessitates that the server your Collector is installed on can make an outgoing HTTPS connection to LogicMonitor’s data centers (note, however, that Collectors can be installed on proxy servers).
Ports Used by Collectors
The server on which a Collector is installed must be able to able to make an outgoing HTTPS connection to the LogicMonitor servers (proxies are supported). In addition, the ports for the monitoring protocols you intend to use (e.g. SNMP, WMI, JDBC, etc.) must be unrestricted between your Collector machine and the resources you want to monitor.
The following tables document how the Collector communicates outbound traffic so that firewall rules can be configured accordingly. Additionally, it highlights the use cases in which the Collector is listening for inbound traffic and, when applicable, the configurations that can be used to update these inbound ports.
Inbound communication
| Port | Protocol | Use Case | Configuration Setting |
| 162 | UDP | SNMP traps received from target devices | eventcollector.snmptrap.address |
| 514 | UDP | Syslog messages received from target devices | eventcollector.syslog.port |
| 2055 | UDP | NetFlow data received from target devices | netflow.ports |
| 6343 | UDP | sFlow data received from target devices | netflow.sflow.ports |
| 7214 | HTTP/ Proprietary | Communication from custom JobMonitors to Collector service | httpd.port |
Outbound communication
| Port | Protocol | Use Case | Configuration Setting |
| 443 | HTTP/TLS | Communication between the Collector and the LogicMonitor data center (port 443 must be permitted to access LogicMonitor’s public IP addresses; If your environment does not allow the Collector to directly connect with the LogicMonitor data centers, you can configure the Collector to communicate through a proxy.) | N/A |
| Other non-privileged | SNMP, WMI, HTTP, SSH, JMX, etc. | Communication between Collector and target resources assigned for monitoring | N/A |
Internal communication
| Port | Protocol | Use Case | Configuration Setting |
| 7211 | Proprietary | Communication between Watchdog and Collector services to OS Proxy service (sbwinproxy/sblinuxproxy) | sbproxy.port |
| 7212 | Proprietary | Communication from Watchdog service to Collector service | agent.status.port |
| 7213 | Proprietary | Communication from Collector service to Watchdog service | watchdog.status.port |
| 15003 | Proprietary | Communication between Collector service and its service wrapper | N/A |
| 15004 | Proprietary | Communication between Collector service and its service wrapper | N/A |
*For instructions on editing a Collector’s configurations, see Editing the Collector Config Files.
Collector Security
The LogicMonitor Collector has been carefully designed and developed with high security in mind. For details on Collector security measures and recommended best practices, see LogicMonitor Security Best Practices.
Note: Windows Defender Credential Guard is not supported and should not be enabled on Windows Collectors. The security platform has application requirements, such as blocking specific authentication capabilities, that may interfere with Collector operation.
Anti-Malware Exemptions
Although the Collector has undergone rigorous security testing prior to release, its traffic patterns may look suspicious to anti-malware tools such as heuristic antivirus or intelligent endpoint detection and response services.
If you run anti-malware software on your Collector, be aware that it may interfere with the Collector’s operations and will require an exemption. For instructions on configuring anti-malware exemptions, see LogicMonitor Security Best Practices.