Linux Collector

System Requirements

• A Linux host with systemd and root or sudo access to install and manage services.
• tar to extract the installer archive, plus this collector's private Config JSON. The installer adds jq, curl, and OpenSSL with the system package manager if they are missing.
• Outbound HTTPS to https://www.secdit.com/configsentry/ and network access to each appliance's SSH port.
• SSH credentials with sufficient read access to retrieve the configuration. Have a trusted way to verify the appliance's SSH host-key fingerprint.
• If using syslog triggers, permit the configured inbound UDP port. Collectors sharing a host need distinct listen IP/port combinations.

How to install it

1. Create a collector on the website. From Appliances → Collectors, download only its private Collector Config JSON and the Linux installer bundle (.tar.gz).
2. Put both downloads in one private working directory and run the two commands below.
3. The installer reads the collector identity and website endpoint from the JSON, verifies the bundled signed release and runtime, installs any missing dependencies, then creates and starts this collector's private services.

tar -xzf ./configsentry-linux-native-installer.tar.gz
sudo sh ./install.sh

If your JSON has a different filename or location, run sudo sh ./install.sh --config-file /path/to/your-config.json instead. Otherwise install.sh automatically finds ./configsentry_collector_install.json.

Complete any locally managed appliance settings, then confirm a first collection and audit on the website. If the first attempt happened before credentials were ready, request a Manual Audit. Delete the extra downloaded private JSON copy when finished.

Menu options and command-line actions

sudo configsentry-collector

The global command lists installed collectors when there is more than one. The installer also prints a direct /opt/configsentry/native/ACCOUNT-COLLECTOR/manage.sh path for this collector.

How to add a collector config file

Create the additional collector on the website and download its own Config JSON. Run the installation steps above again with that JSON; an already downloaded installer archive can be reused for the same platform release. The installer creates a separate instance and services without replacing existing collectors. Give each syslog listener on the same computer a different local UDP port. Never reuse another collector's JSON or credentials.

Configure an appliance and syslog

1. Assign the appliance to this collector on the website. Open the menu and choose Install config updates if you want the new assignment immediately.
2. Choose Edit locally configured settings, select the appliance by name, and supply any host or SSH values marked Enter Locally. Test before saving. Verify a newly presented SSH host key through a trusted channel.
3. For event-triggered collection, enable syslog on the website. Use Syslog configuration to check the listen IP and UDP port or change them if local management is enabled. Send FortiGate config-change events to that address and permit the UDP port through the host firewall.

The default listener is 0.0.0.0:2216/UDP, unless configured otherwise. See the FortiGate syslog guide for the appliance-side filter.

How to update it

When automatic updates are enabled, the updater handles both signed runtime and website configuration updates. If disabled, open this collector's menu and choose Install collector updates or Install config updates; review the result and confirm an available update.

After adding an appliance or changing website settings, Install config updates also checks for the new assignment immediately. Verify its initial audit on the website.

How to remove a collector config

Open that collector's manage.sh and choose Uninstall this collector. Confirm by typing UNINSTALL. This removes only that instance's local services, configuration, encrypted credentials, state, logs, and runtime. Its website record is not deleted. Disable collector service only stops it; it does not remove the config.

How to completely uninstall it

Uninstall each collector instance through its own menu. When removing the final instance, accept the separate prompt to remove the shared native service files and global management command too. If you also want the website record removed, delete it separately on the website after preserving anything you need.