Components of the Collector

Overview

The Collector is composed of a set of services and libraries that gather information about the devices in your corporate network and their activity. The Collector periodically sends all the gathered information to an Engine, where it is processed and stored. Additional components of the Collector deal with the features provided by optional Nexthink products. Finally, other components help you with the installation and configuration of the Collector.

Find in this document the description of all the different components of the Collector and the filesystem paths where to find them in the devices of the end users after installation. This article details as well the registry keys and the additional files created or modified during the installation of the Collector.

Applies to platforms | Windows | macOS |

Windows Collector

The Windows version of the Collector includes the following set of components.

Applies to platform | Windows |

Windows Collector binaries

For all versions of Windows, the following components are installed:

Main driver

A kernel mode driver that gathers valuable information from the device of the end-user.

Network specific driver

A kernel mode driver that detects network connections.

Helper service

A Windows service that complements the main driver by collecting additional information.

Printing info library

A dynamic link library that is responsible for detecting printing activity.

Automatic updates

A component of the Collector that is responsible for downloading new versions and updating the installed components.

Coordinator

Coordination of the Collector with the Appliance to detect new updates, engage with end-users, and execute remote actions.

Nexthink Engage

Components for presenting the questions of campaigns and getting answers from the end-users.

Nexthink Act

Components that manage the execution of remote actions.

Nexthink Reporter

A troubleshooting tool that creates debug reports for specific support cases.

Nexthink Event Log Provider

A component for logging events in the Windows Event Log.

Nexthink Application Experience

A component for monitoring business applications.

Command line configuration tool (optional)

A tool to configure the Collector from the command line.

Control Panel extension (optional)

A tool to control the behaviour of the Collector that is added to the Control Panel of Windows.

Component	File	Path
Main driver	nxtrdrv.sys	%Windows%\System32\drivers
Network specific driver	nxtrdrv5.sys	%Windows%\System32\drivers
Helper service	nxtsvc.exe	%ProgramFiles%\Nexthink\Collector\Collector
Printing info helper library	nxtdll.dll
Nexthink Event Log Provider	nxteventprovider.dll
Immersive apps	nxtwrt.dll
Application start time	nxtwpm.dll
Application start time (32 bit)	nxtwpm32.dll nxtusm.exe	%Windows%\SysWOW64
Application start time	nxtwpm.dll
Coordinator service	nxtcoordinator.exe	%ProgramFiles%\Nexthink\Collector\Coordinator
Engage coordinator	nxteufb.exe
Act coordinator	nxtcod.exe
Updates coordinator	nxtupdater.exe
OpenSSL (64 bit)	libcrypto-1_1-x64.dll libssl-1_1-x64.dll
OpenSSL (32 bit)	libcrypto-1_1.dll libssl-1_1.dll
Nexthink Engage	nxtray.exe nxtray.exe.config	%ProgramFiles%\Nexthink\Collector\Engage
Nexthink Act	Google.Protobuf.dll nxtcampaignaction.dll nxtremoteactions.dll	%ProgramFiles%\Nexthink\Collector\RemoteActions
Nexthink Reporter	nxtreporter.exe	%ProgramFiles%\Nexthink\Collector\Reporter
Nexthink Application Experience	nxtbsm.exe	%ProgramFiles%\Nexthink\Collector\BSM
Command line configuration tool	nxtcfg.exe	%Windows%\System32
Control Panel extension	nxtpanel.cpl	%Windows%\System32

Registry keys of the Windows Collector

On installation, the Collector creates the following keys in the Registry of Windows:

CODE

HKEY_CLASSES_ROOT\nxtrayproto
HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector
HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AppStartTime
HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\DN
HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\RebootMarker
HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\RemoteActions
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\Nexthink Collector
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator\params
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator\Modules\COD
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator\Modules\EndUserFeedback
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nexthink Coordinator\Modules\Updater
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Nexthink Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Nexthink Service\runtime_stats
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nxtrdrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nxtrdrv\params
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nxtrdrv5
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nxtrdrv5\Parameters\Wdf
HKEY_LOCAL_MACHINE\SYSTEM\Nexthink\Updater
HKEY_USERS\S-1-5-21-[X-X-X-X]\SOFTWARE\NEXThink\NxTray

Additional files of the Windows Collector

Find the log files of the Collector here:

%windir%\nxtsvc.log
%windir%\nxtsvc.1.log
%windir%\nxtsvc.2.log
%windir%\nxtupdater.log
%windir%\nxtupdater.1.log
%windir%\nxtupdater.2.log
%windir%\nxtcoordinator.log
%windir%\nxtcoordinator.1.log
%windir%\nxtcoordinator.2.log
%windir%\nxteufb.log
%windir%\nxteufb.1.log
%windir%\nxteufb.2.log
%windir%\nxtcod.log
%windir%\nxtcod.1.log
%windir%\nxtcod.2.log
%temp%\nxtray.log
%temp%\nxtray.log.<timestamp>

Finally, Windows creates a cached copy of the kernel drivers in two folders whose names start with the name of the drivers (nxtrdrv and nxtrdrv5, respectively) followed by an unique identifier that depends on the version of the driver itself. Find the folders here:

%windir%\System32\DRVSTORE

The Nexthink Reporter tool creates its logs and reports here:

%temp%\nxtreporter[reportID].log
%temp%\nxtreport-[hostname]-[reportID].zip

Mac Collector

The Mac version of the Collector includes the following set of components.

Applies to platform | macOS |

Mac Collector binaries

Main service: A Mac daemon that gathers valuable information from the device of the end-user.
Coordination service: A Mac daemon that synchronizes with the appliances to provide services such as automatic updates, end-user engagement and execution of remote actions in the near future.
Nexthink Application Experience: A Mac daemon that is in charge of gathering specific data for business applications.

Component	File	Path
Main service	nxtsvc	/Library/Application Support/Nexthink
Coordination service	nxtcoordinator
Nexthink Application Experience	nxtbsm

Configuration files of the Mac Collector

Starting from V6.21, there is only one configuration file for the Mac Collector:

Component	File	Path
Configuration file	config.json	/Library/Application Support/Nexthink

At the end of the file config.json, find the exact version of the installed Collector and the status of the TCP connection.

Additional files of the Mac Collector

Find the log files of the Mac Collector here:

/Library/Logs/nxtsvcgen.log
/Library/Logs/nxtsvcgen.n.log (n positive, when previous log is rotated)
/Library/Logs/nxtcoordinator.log

RELATED TASKS

RELATED REFERENCES