Collected data
The commands and files that the collection script reads on each host. The script only reads.
| Data | Command or file |
|---|---|
| Hostname, machine ID, OS | hostname -f, /etc/machine-id, /etc/os-release |
| Addresses | ip -o addr show |
| Processes | ps -eo pid=,unit= and ps -eo pid=,args= |
| TCP sockets | sudo -n ss -tanpH (or ss -tanpH without sudo) |
| Containers | /proc/<pid>/cgroup, /proc/<pid>/net/tcp, /proc/<pid>/net/tcp6, /proc/<pid>/net/fib_trie |
| Container names | docker ps and podman ps, if the user can run them |
What leaves the collector
The report has the hostname, the machine ID, the OS name, the addresses, and for each service: its name, its listens and its connections. See Report format.
The command lines of the processes never leave the collector, because they can contain passwords. The collector uses them only to tell two processes with the same name apart, with a short hash.