Decide what Collectord collects on your organization’s Macs before you deploy it. This page lists the sources that name people or programs, and the switch for each.
Collectord runs on Macs your organization owns: its build farm, its CI runners, its employees’ laptops. What it sends by default is what the people running those Macs need, chosen by what it costs to index in your Splunk. Every source can be turned off, in the configuration or with a managed preference, for a fleet that wants less.
What names people and programs
| Source | What it shows | Switch |
|---|---|---|
| Process records | the top executables by CPU and memory, with what they used; a busy process’s events name its path and its user | [input.macos_processes] disabled = true, or ProcessStats false; busy = false for the busy-process events alone |
| Connections | each process’s remote addresses and ports and the bytes it moved, so on a laptop the sites a browser talks to | [input.macos_connections] disabled = true, or Connections false; traffic = false stops the bytes |
| Application inventory | every installed application, the users’ own ~/Applications included, whose paths name the user | [input.macos_apps] disabled = true, or Apps false; userDirectories = false for /Applications alone |
| Log packs | message text as programs wrote it: the security pack forwards sshd’s and sudo’s lines, which name accounts and the commands sudo ran | the pack’s disabled, or LogPacks |
| Noise sampler | format strings with their counts, and one sample message per noisy template, which can carry anything a process logs | [input.macos_logs] noiseSampler.samples = false sends the counts alone; noiseSampler = false turns it off |
| Crash reports | the crashed program; a report from a user’s own folder carries its path, which names the user | [input.macos_crash_reports] userDirectories = false reads only /Library/Logs/DiagnosticReports |
| Users | the user at the console, every terminal, SSH and background session with the host it comes from, and each login and logout | [input.macos_status] users = false |
| Local accounts | every local account and which are administrators, and each account created, deleted, or given or stripped of administrator rights | [input.macos_status] accounts = false |
| Network addresses | each interface’s IP and MAC addresses | [input.macos_status] interfaces = false |
| Paths | a filesystem mounted under a home, a network share with the account it was mounted with (never a password in its address), and each user’s Xcode storage | [input.macos_stats] filesystems.remote = false (the default) keeps network shares out; [input.macos_status] xcode = false |
The host record also carries the Mac’s serial number, which an MDM and an asset inventory join the Mac on.
What it does not collect
No input reads the app in front, per-app usage time, Wi-Fi network names or location.
macOS itself hides much of what programs log. A value a program does not mark public reads <private> in the unified log for every reader, Collectord included, and most strings and objects are such values. Only a configuration profile your organization deploys can lift that, for every reader of the log on that Mac. Collectord cannot (see Log forwarding).
Permissions
Collectord runs as a LaunchDaemon, as root, and needs no Full Disk Access or other privacy permission. The unified log, every user’s crash reports and applications, every process’s sockets and the install log all read without one. So the package grants none, and macOS asks the user nothing.
Without the Managed Login Items profile, macOS tells the user a background item was added, and an administrator can switch it off in System Settings › General › Login Items.
The configuration file that holds the HEC token and the license, /opt/collectorformacos/etc/002-user.conf, is readable by root only. Settings a configuration profile delivers are written to /Library/Managed Preferences, which every user of the Mac can read. Give a token delivered that way the macOS indexes only, or keep it in 002-user.conf.
Where the data goes
Collectord sends what it collects to your Splunk, over the HTTP Event Collector, and nowhere else. It checks its license with our license server, and forwards anonymous telemetry there. To turn the telemetry off, set telemetryEndpoint empty under [general] (see Configuration).