Skip to main content

Devices: Management

The Devices web interface provides comprehensive management for data collection sources through a card-based interface.

Access​

Navigate to Home > Fleet Management > Devices, or use the hamburger menu and select Fleet Management > Devices.

Overview​

The Devices page is where you manage all configured devices through the web interface. To standardize data collection rules across multiple devices, see Datasets and Profiles.

Interface​

The overview page displays the available device types as cards, grouped into the same ten categories as the documentation catalog: Operating systems, Microsoft Azure, Amazon Web Services, Google Cloud, Message queues, Protocols, Analytics, Databases, Honeypots, and Other. For the full set of device types and what each one collects, see Devices: Catalog.

A sidebar filter panel allows selection by category. The interface provides a Search device types field to filter by name. A card count displays "Viewing X device type(s)".

Each device type displays as a card showing Icon, Title, Description, Enabled Count, and Disabled Count. Clicking a card navigates to that device type's management page. Device types that are not yet released are hidden from the card grid and from the category filter, rather than being listed as unavailable.

List View​

Clicking a device card opens the device list view showing all instances of that device type.

Table​

The table displays Name, Director, Log stream (per-row bar chart of recent throughput), Status (Enabled/Disabled), Connection status (Connected/Not Connected), and an Actions menu (⋮) for each device.

Clicking a row's Name opens a side drawer (Device Detail Drawer) summarizing the device — see Device Detail Drawer below.

info

Every device but a Windows, Linux, Oracle Solaris, AIX or macOS device can have a pre-processing pipeline (those devices' datasets each carry their own). On a device that takes datasets, it is the pipeline for the records of the datasets that name none of their own: a dataset's own pipeline replaces it.

The Windows, Linux, Oracle Solaris, AIX and macOS device types share one list page, with columns of its own:

  • Name
  • Director
  • Deployment type — Agent or Agentless
  • Version — the Agent's version, with an update icon beside it when a newer version is available ("Update available: <version>")
  • Log stream
  • Status
  • Monitoring — the device's alert state: Critical, Warning, Notice or OK, or Not monitoring when no rules are configured and Not monitored when the device is disabled. For a user who may read alerts, the first four link to the device's open alerts in Alerts
  • Connection status

Name, Deployment type, Version and Status can be sorted.

On Oracle Solaris, AIX and macOS, a host its Director reads over SSH has no Agent. It is listed as Agentless, its Version shows -, and it is Connected while its Director can read it.

The page of each of these five device types has two tabs: Devices, the list described here, and Templates, the device type's Enrollment Templates.

Table Controls​

Filter devices using a search field with a dynamic placeholder of Search [Device Type] devices (for example, Search Syslog devices), a Directors dropdown (All or specific Director), and a Status dropdown (All, Enabled, Disabled).

A Connection filter (All, Connected, Not connected) is available on the Windows, Linux, Oracle Solaris, AIX and macOS device-type pages, where the table lists Agent and Agentless devices.

The Add new device toolbar button launches the creation wizard. This button is disabled if no Director exists.

Director Requirement

On the Windows, Linux, Oracle Solaris, AIX and macOS device-type pages, if no Directors exist an info notification displays No directors found with an explanation and a Create director button that navigates to the Director creation wizard. The notification is shown to a user who may create Directors.

Actions​

Each device row provides an Actions menu (⋮) with the following operations:

View Details:

  • Manage device - Navigate to the device detail view

For users with read-only access (no Create/Edit/Delete permission), this item is replaced by See device details, which opens the same detail view without edit controls.

Status Management:

  • Enable device - Activate a disabled device
  • Disable device - Deactivate an enabled device

Configuration:

  • Clone device - Duplicate device configuration for quick setup

Deletion:

  • Delete device - Remove device from platform

Bulk Actions​

Every device list, the Windows, Linux, Oracle Solaris, AIX and macOS lists included, has a checkbox on each row. Ticking one or more rows opens a bar above the table that shows how many are selected and offers Enable, Disable, Delete and Cancel. The selection is kept when you move to another page. An action runs on at most 500 devices at a time: above that, the bar says so and its actions are disabled.

  • Enable and Disable set the status of every selected device. A toast reports the outcome, including how many could not be changed.
  • Delete asks for confirmation first ("Delete 2 devices?"). A device that is assigned to a route is not deleted; the others are. When every device is deleted, a toast confirms it. When some could not be deleted, a result dialog (for example "Deleted 3 of 5 devices", or "Nothing was deleted") lists them grouped by reason, with links to the routes that use them.
  • Cancel clears the selection.

The checkboxes appear only for a user who may edit or delete devices. Enable and Disable need the permission to edit devices, Delete the permission to delete them.

Device Detail Drawer​

Clicking the Name cell in the device list opens a side drawer that summarizes the device without leaving the list. The drawer displays:

  • Name
  • Directors assigned
  • Pre-processing Pipeline
  • Status
  • Connection status

On the Windows, Linux, Oracle Solaris, AIX and macOS lists, the drawer shows Name, Director, Deployment type, Version, Status and Connection status instead.

The drawer footer provides two actions:

  • Manage device - Navigate to the device detail page
  • Clone device - Open the creation wizard pre-filled with this device's configuration

Creation Wizard​

The device creation process varies by device type.

Device wizards use different step counts depending on the device family:

  • Generic devices (protocols, cloud, message queues, analytics, AWS/GCP/Azure storage) — 4 or 5 steps: General Settings, followed by two or three device-specific steps, ending with Review. The listeners that carry a source-IP access list use three — Splunk S2S, for instance, has Protocol settings, Access settings and Advanced settings.
  • Windows, Linux, Oracle Solaris, AIX and macOS devices — 5 steps, under either deployment type: Setup Device, Install and connect, Data collection, Update management, Review and Complete Setup. When an Agentless deployment is chosen, the Update management step is disabled.

Each step is labeled with its specific name rather than a generic step number.

Orchestrated Director Behavior​

The device creation wizard offers an Orchestrated Director like any other Director. Every device type can be assigned to it, and Windows and Linux devices can use Agent or Agentless deployment. Only a Director's connection status disables it as an option.

Director Dropdown: Orchestrated Directors display with a gray Orchestrated tag next to their name in the Director selection dropdown, distinguishing them from Self-Managed and Managed Directors.

Connection Verification (Windows/Linux): Only a Self-Managed Director skips the access check: its Agent's connection status updates once the Director's configuration is applied by hand. Orchestrated and Serverless Directors run the check as Managed ones do. For an agentless device, Create device waits for the access check to pass; for an Agent, the install step waits for the Agent to connect and offers Connect later. If there is a connection issue, review the Director logs.

General Settings​

Applies to: Syslog, HTTP, UDP, TCP, eStreamer, AzureBlobStorage, AzureEventHubs, AzureServiceBus

Basic device configuration including name and Director assignment:

  • Device name - Unique device identifier
  • Status - Enable or disable device
  • Directors - Assign device to one or more Directors
  • Pre-processing Pipeline - Optional pipeline for input normalization

Protocol Settings​

Applies to: Syslog, HTTP, UDP, TCP, eStreamer

Network protocol configuration:

  • Protocol - Communication protocol (UDP, TCP, HTTP, etc.)
  • Listen address - Network address to bind (0.0.0.0 for all interfaces)
  • Port - Network port number for listening
  • Framing - Message framing mode (delimiter, RFC6587, etc.)
  • TLS encryption - Optional TLS/SSL configuration
  • Certificate and Key - TLS certificate files when encryption enabled

When the device is assigned to a container Director, the console checks the Port as it is entered and shows one alert per Director under the field, naming the ports that Director publishes. How the alert reads depends on the Director's container type:

  • Azure Container Apps, Azure Container Instances - The alert is an error, and Next stays disabled until the port and the protocol together match a listener the Director publishes
  • Docker, Kubernetes - The alert is a warning, judged against the default deployment template. If you published the port in your own Compose file or manifest, the device can still be saved as it is

See Device Listener Ports for the ports each container type publishes.

Advanced Settings​

Applies to: Syslog, HTTP, UDP, TCP, eStreamer, AzureEventHubs

Performance tuning and advanced settings:

  • Socket Address Reuse - Enable SO_REUSEADDR for port sharing
  • Workers - Number of concurrent processing workers
  • Maximum connections - Maximum concurrent connections limit
  • Maximum message size - Maximum message size in bytes
  • Timeout - Connection and read timeout settings
  • Buffer size - Input buffer size for data reception
  • Batch size - Number of messages per batch
  • Queue interval - Queue processing interval
  • Forwarding - Optional forwarding to another destination

Setup​

Applies to: Windows, Linux, Oracle Solaris, AIX, macOS

Initial device configuration and deployment type selection:

  • Device name - Device identifier
  • Director - Director assignment for Agent coordination
  • Processor (Oracle Solaris only) - x86 (64-bit) or SPARC; a SPARC host is always read over SSH, so it is not asked the deployment type
  • Deployment type - Choose between Agent-based or Agentless connection
    • Agent - Install VirtualMetric Agent on target system
    • Agentless - The Director signs in to the host over WinRM or SSH and installs the Agent. On Oracle Solaris, AIX and macOS, the Director reads the host over SSH and installs nothing
  • Description (optional) - Free text, up to 100 characters
  • Tags (optional) - Labels for categorizing the device; press Enter or type a comma after each tag
  • Buffer settings - Collapsed; Show advanced settings opens Retention (1 hour to 365 days, in hours or days; 24 hours when left empty) and Maximum backlog size (1 MB to 1 TB, in MB, GB or TB; sized automatically when left empty). Offered for both deployment types, except an agentless Oracle Solaris, AIX or macOS device, which runs no Agent

Install and Connect​

Applies to: Windows, Linux, Oracle Solaris, AIX, macOS

Agent installation or agentless connection configuration (varies by deployment type):

For Agent Deployment:

  • Installation command - Platform-specific PowerShell/Bash script
  • Install on a host without the director's CA certificate (Windows only) - With the Director's Discovery Endpoint disabled, and when the platform can pin the Director's certificate (not with TLS offloading, behind a Container Apps ingress, or for a custom certificate behind an external URL), a second command under the first, which pins the Director's certificate and so needs no CA on the host. The first command is then for a host that has the Director's CA installed, and Download CA certificate beside it downloads that CA. See TLS and Certificates
  • Copy Button - One-click copy installation command
  • Connection Verification - Verify Agent successfully connected to Director
  • Connection status - Real-time connection state display

For Agentless Deployment:

  • Address - Target server address
  • Port - WinRM or SSH connection port
  • Timeout - Connection timeout in seconds (default: 30)
  • Host key (optional; Oracle Solaris, AIX and macOS only) - The host's SSH key, as a SHA256: fingerprint or the public key
  • Username - Authentication username
  • Password - Authentication password (or use SSH Key on Linux, Oracle Solaris, AIX and macOS)
  • Private key and Passphrase - Private key content and optional passphrase, shown when the SSH key authentication checkbox is ticked (SSH hosts only, replaces password)
  • Domain - Windows domain for Active Directory authentication (optional)
  • Connection Verification - Test remote connection before proceeding

Data Collection​

Applies to: Windows, Linux, Oracle Solaris, AIX, macOS

Log type selection and configuration review:

  • Log Categories - Accordion-based log type selection with predefined definitions
  • Windows Log Types:
    • Event Logs (Basic/Custom modes with XML editor)
    • Security Events (with log level filtering)
    • DNS Logs (with include/exclude filters)
    • Firewall Logs (with event type selection)
  • Linux Log Types:
    • System Events (with file path configuration)
    • Audit Events (with file path configuration)
    • Firewall Events (with file path configuration)
  • Pre-processing Pipeline (Windows and Linux) - Optional pipeline assignment per log type
  • Configuration Summary - Review all settings before creation

Azure Settings​

Applies to: AzureBlobStorage, AzureEventHubs, AzureServiceBus

Azure-specific authentication and resource configuration:

For AzureBlobStorage and AzureEventHubs:

  • Managed Identities - Toggle for Azure Managed Identity authentication
  • Authentication method - Service Principal or Connection String
  • Tenant ID / Client ID / Client Secret - Service Principal credentials
  • Account / Container / Namespace - Azure resource identifiers
  • Connection string - Alternative authentication method

For AzureServiceBus:

There is no Managed Identities toggle. The Azure settings step has two sections:

  • Connection
    • Authentication method - A dropdown with four choices: Connection string, Service principal (Tenant ID, Client ID and Client Secret), Managed identity (user-assigned) (Client ID), and Managed identity (system-assigned) or workload identity (no credentials). Only the chosen method's fields are saved
    • Namespace - The Service Bus namespace; asked for every method except Connection string
    • Transport - AMQP, port 5671 or AMQP over WebSockets, port 443
  • Source entity
    • Receive from - Queue (a queue name) or Topic subscription (a topic and one of its subscriptions)
    • Sub-queue - None, Dead-letter queue, or Transfer dead-letter queue

The Advanced settings step follows, with two sections:

  • Receiving - Receive mode (Peek-lock or Receive and delete; a warning says a message is lost if the pipeline fails to process it), Maximum lock renewal, Prefetch count, Maximum messages per receive, and a Sessions toggle. With sessions on, Maximum sessions is shown; with sessions off, Workers. Sessions can be enabled only when Sub-queue is None
  • Message decoding - Content encoding (None, gzip or Automatic) and Maximum decompressed size

For the configuration keys, defaults and ranges behind these fields, see Azure Service Bus.

Blob Settings​

Applies to: AzureBlobStorage

The Blob settings step sets how the Director finds and reads the blobs in the container. Every field except Ingestion mode is optional. An empty field is not saved, so the Director uses its default.

  • Ingestion
    • Ingestion mode - Two tiles. Queue, the default, reads each blob as Event Grid reports it on a storage queue named after the container. Poll lists the container on a schedule and reads the blobs added since the last run, with no queue. Each mode saves only its own settings. A field the other mode uses keeps its value, so switching back restores it
    • Prefix - Only blobs whose names start with this prefix are read. With Poll, the prefix may contain the date tokens %Y, %y, %m, %d, %j and %H (UTC), which limit each run to the partitions between Start and End; such a prefix requires Start. With Queue, date tokens are rejected. Write %% for a literal percent sign
    • Blob name filter - A regular expression. Only blobs whose names match it are downloaded. Defaults to .*, every blob
    • Time zone - An IANA name such as Europe/Istanbul or an offset such as +03:00, stamped on every record. With Poll, it also applies to relative values of Start and End and to timestamps without an offset. Defaults to UTC
  • Queue settings - Shown when Ingestion mode is Queue
    • Batch size - The most blob notifications read in one request, from 1 to 32. Defaults to 32
    • Pollers - How many loops read the queue at once, from 1 to 16. Defaults to 2
    • Visibility timeout - How long the queue hides a notification while the Director reads it, in seconds, from 1 to 604800. Set it longer than a blob takes to read and deliver, or the blob is read twice. Defaults to 300
  • Poll settings - Shown when Ingestion mode is Poll
    • Poll interval - How often the container is listed, in seconds. When Cron expression is also set, a run starts when either one is due. Defaults to 60 when both are empty
    • Cron expression - Lists the container on this schedule: five fields starting with the minute, or six starting with the second
    • Start - The oldest last-modified time to read: an RFC 3339 timestamp, Unix seconds or a relative expression such as -1mon@mon. Leave it empty to read the whole container on the first run
    • End - The newest last-modified time to read. Leave it empty to keep reading new blobs. With an end, the device idles once every blob up to it has been read
    • Maximum retries - How many runs in a row a blob may fail before it is skipped. Defaults to 0, no limit
  • Limits
    • Workers - How many blobs are downloaded and decoded at once, from 1 to 64. Defaults to a quarter of the Director's CPU cores, at least 1
    • Maximum blob size - The largest blob that is downloaded, in bytes. Larger blobs are skipped. Defaults to 100000000 (100 MB)
    • Maximum archive size - The largest total size of the files extracted from one archive, in bytes. Larger archives are skipped. Defaults to 104857600 (100 MB)
    • Maximum files in archive - The most files extracted from one archive. Archives with more files are skipped. Defaults to 100

For the configuration keys behind these fields, see Azure Blob Storage.

Wizard Navigation​

Progress Indicator:

  • Visual step progress at top of wizard
  • Click steps to navigate (after validation)
  • Current step highlighted
  • Completed steps marked with checkmark

Navigation Buttons:

  • Cancel - Exit wizard without creating device
  • Back - Return to previous step
  • Next - Advance to next step with validation
  • Create device - Finalize device creation (final step)

Detail View​

Clicking a device from the list opens the detailed management interface with tabbed panels.

Protocol Devices​

Protocol devices (Syslog, HTTP, UDP, TCP, eStreamer) display three tabs:

General Settings Tab:

  • Device name - Editable device name
  • Description - Editable device description
  • Director - Assigned Director (read-only)
  • Tags - Editable device tags
  • Status - Current operational state
  • Edit Mode - Click edit to modify general settings
  • Save/Cancel Buttons - Commit or discard changes

Protocol Settings Tab:

  • Device-specific network configuration
  • Address and port settings
  • Protocol parameters
  • Read-only display with configuration details

Advanced Settings Tab:

  • TLS/SSL settings
  • Buffer and queue configuration
  • Performance tuning parameters
  • Read-only display with configuration details

Windows, Linux, Oracle Solaris, AIX and macOS Devices​

Windows, Linux, Oracle Solaris, AIX and macOS devices have different tab structures based on deployment type. An agentless Oracle Solaris, AIX or macOS device, which its Director reads over SSH, has the agentless tabs: Device overview, Access settings, Data collection, Health, Live data and Activity logs. Its page has no status switch and no pipeline field; a pipeline already set on the host is kept, but the page no longer shows it.

Agent-Based Devices (3-4 tabs):

Device Configuration Tab:

  • Device name - Editable device name
  • Description - Editable; an empty one shows a dash
  • Tags - Editable; an empty list shows a dash
  • Director - Assigned Director
  • Deployment type - Agent-based or Agentless
  • Buffer settings - Retention and Maximum backlog size, for both deployment types. Read-only, under a note that the deployment reads its configuration from disk, when the platform cannot push a configuration to the Agent: its Director is self-managed, or its Cluster is self-managed or has no Director
  • Edit Mode - Modify device settings
  • Save/Cancel - Commit or discard changes

Access Configuration Tab:

  • For Agent devices - Token assignment; view current token or change to a different valid token
  • For Agentless devices - Remote connection credentials (IP Address, Port, Timeout, Username, Password/SSH Key, Domain). On Oracle Solaris, AIX and macOS, Host key shows beside Timeout, reading Trusted on first use when no key is pinned, and there is no access token, because no Agent runs on the host. Check access in the editor has the Director log in with the stored password or key, so a changed timeout or host key can be checked without typing the password again
  • Edit Mode - Modify access settings

Agent Deployment Tab (Agent-based only):

  • Deployment type - Agent or Agentless indicator
  • Access token - Authentication token in use
  • Connection status - Connected or Not Connected
  • Connection history - Connected at with the date the agent first connected, or the date the device was created for an agent that has not connected yet. There is no link to a fuller history
  • Installation command - Platform-specific script with copy button
  • Re-Install Agent - Click to reinstall; select token, copy new installation script, verify connection. On Windows, with the Director's Discovery Endpoint disabled, it shows the same two commands as the creation wizard, under the same conditions: the installation command, with Download CA certificate beside it, and the command under Install on a host without the director's CA certificate

Data Collection Tab:

On this tab, you select which log types to collect from the Windows device. The interface provides accordion-based sections for different log categories.

Each log type supports optional pre-processing pipeline assignment - allowing you to transform or enrich data before it reaches the main processing pipeline.

Windows Security Events:

  • Security audit logs from Windows Event Log
  • Configurable log level filtering
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Windows Event Logs:

  • Category Selection - Choose between Basic and Custom modes
  • Basic Mode:
    • Pre-configured log level checkboxes
    • Application and System channel options
    • Log level selection (Information, Warning, Error, Critical, Verbose)
    • Simple checkbox-based configuration
  • Custom Mode:
    • XML Configuration Editor - Monaco code editor for XPath queries
    • DCR Format Import - Import button to convert Azure DCR format to XML
    • Import DCR Config modal with XML editor
    • System converts DCR to XPath automatically
    • Full custom query support for advanced scenarios
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Windows Firewall Logs:

  • Multiple firewall log options with tick boxes
  • Configurable firewall event types
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Windows DNS Logs:

DNS logs provide the most complex filtering with include/exclude logic:

Include Filters - Specify which DNS events to collect:

  • Add New Filter button opens filter configuration
  • Multiple filters can be added (treated with OR logic between filters)

Exclude Filters - Specify which DNS events to ignore:

  • Same interface as Include filters
  • Processed after include filters

Filter Configuration:

For each filter (include or exclude), you configure:

  1. Filter Type Selection - ComboBox with options:

    • Event ID
    • Response Code
    • Question Type
    • Client IP
    • Query Name
    • And other DNS-specific fields

  2. Filter Type Selection - ComboBox showing operators based on Filter selection:

    • For Event ID, Response Code, Question Type: Only "Equals" operator (MultiSelect values)
    • For text fields (Client IP, Query Name, etc.): Multiple operators available
      • Equals
      • Contains
      • Starts With
      • Ends With
      • And other string comparison operators

  3. Value Input:

    • MultiSelect Dropdown (for Event ID, Response Code, Question Type)
      • Pre-defined value list
      • Select multiple values from dropdown
    • TextArea Input (for text fields)
      • One value per line
      • Free-form text entry

  4. Additional Filter Types (for TextArea filters only):

    • "Add Another Type" button appears after selecting filter type
    • Allows multiple filter types on same field
    • Each additional type treated conjunctively (AND logic)
    • Info alert explains: "Multiple types within a condition are treated with AND logic"

  5. Multiple Conditions:

    • "Add Condition" button adds another condition to the filter
    • Each condition can have different Filter and Filter Type
    • Multiple conditions within a filter treated conjunctively (AND logic)
    • Info alert explains: "Multiple conditions are treated with AND logic"

  6. Filter Management:

    • Save Filter button validates and adds filter to list
    • Edit button on each filter row reopens configuration
    • Delete button removes filter
    • Cancel button discards changes

Filter Logic Summary:

  • Within a filter: Multiple conditions use AND logic
  • Within a condition: Multiple additional types use AND logic
  • Between filters: Multiple filters use OR logic

Pipeline Selection:

  • Optional Pre-processing Pipeline - ComboBox at bottom of DNS logs section
  • Applies to all DNS events collected by this log type
  • Transforms or enriches DNS data before main processing

Data Collection Edit Mode:

  • Click Manage device details button to enter edit mode
  • Accordion toggles become enabled for log type selection
  • Filter configuration inputs become editable
  • Save Changes button commits all modifications
  • Cancel button reverts to previous configuration

Agent History Tab:

  • Connection Events - Agent connection/disconnection log
  • Configuration Changes - Device configuration updates
  • Status Changes - Enable/disable operations
  • Timestamp - Date and time of each event

Linux Devices​

Linux devices follow the same structure as Windows devices with platform-specific log types and configuration.

Device Configuration Tab:

  • Same as Windows device (Device name, Description, Tags, Director, Deployment type, Buffer settings)

Access Configuration Tab (Agentless only):

  • Same as Windows device (IP Address, Port, Authentication, Domain)

Agent Deployment Tab (Agent-based only):

  • Same as Windows device (Installation Command, Connection Status, Agent Information)

Data Collection Tab:

Linux devices provide three log type categories for collection. The interface is similar to Windows but with Linux-specific log sources.

Each log type supports optional pre-processing pipeline assignment - allowing you to transform or enrich data before it reaches the main processing pipeline.

Linux System Events:

  • System logs from Linux syslog daemon
  • File path - Input field to specify log file location
    • Tooltip with information icon explains path requirements
    • Default behavior if empty:
      • Ubuntu/Debian: /var/log/syslog
      • Red Hat/CentOS/Fedora: /var/log/messages
    • Custom paths can override defaults
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Linux Audit Events:

  • Audit logs from Linux auditd system
  • File path - Input field to specify audit log file location
    • Tooltip with information icon explains path requirements
    • Default behavior if empty: System uses distribution-specific default path
    • Typically /var/log/audit/audit.log on most distributions
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Linux Firewall Events:

  • Firewall logs from iptables/nftables
  • File path - Input field to specify firewall log file location
    • Tooltip with information icon explains path requirements
    • Default behavior if empty: System uses distribution-specific default path
    • Custom paths allow collection from non-standard locations
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Linux Data Collection Edit Mode:

  • Click Manage device details button to enter edit mode
  • Accordion toggles become enabled for log type selection
  • Path input fields become editable when accordion is toggled on
  • Pipeline ComboBoxes become enabled for selection
  • Save Changes button commits all modifications
  • Cancel button reverts to previous configuration

Path Configuration Notes:

  • Empty path field uses distribution-specific defaults
  • Custom paths must be absolute paths (e.g., /custom/log/location)
  • Agent must have read permissions for specified paths
  • Tooltip information icon provides platform-specific guidance

Azure Cloud Devices​

Azure cloud devices display three tabs:

General Settings Tab - Name, description, Director, tags

Azure Properties Tab:

  • Cloud-specific configuration
  • Authentication details
  • Connection strings
  • Workspace information
  • Read-only display

Advanced Configuration Tab (varies by device):

  • Performance tuning
  • Retry logic
  • Error handling
  • Read-only display

Detail Actions​

The detail view provides an Actions menu with context-specific operations:

View and Configuration:

  • Manage device - Current view (disabled in dropdown)

Status Management:

  • Enable device - Activate a disabled device
  • Disable device - Deactivate an enabled device

Advanced Operations:

  • Clone device - Duplicate configuration for new device. Agent detail pages offer it too.
  • Export template - Open the device as a Bicep template, to deploy again or to change first (see Export Template). Agent detail pages offer it too.
  • Delete device - Remove device from platform

Operations​

Enable / Disable​

To change device status:

  1. Navigate to the device detail view or use the Actions menu from the list
  2. Click the Actions menu
  3. Select Enable device or Disable device
  4. A success notification confirms the status change

Enabled devices actively receive or collect data. Disabled devices preserve their configuration but stop all data collection.

Clone​

Duplicate an existing device configuration for quick setup:

  1. Navigate to the device detail view or use the Actions menu from the list
  2. Click the Actions menu
  3. Select Clone device
  4. The system navigates to the device creation wizard
  5. The form is pre-filled with the cloned device configuration
  6. Modify name and other settings as needed
  7. Complete the wizard to create the new device

On a Windows, Linux, Oracle Solaris, AIX or macOS device, in both deployment types, Clone device is in the list's row menu, in the list's side panel and in the device page's Actions menu. It opens the five-step wizard the device was added in. The clone is named "Copy of" followed by the source device's name. It keeps the Director, deployment type, description, tags, access settings, buffer settings, datasets or profiles and the device's own update policy. It does not copy the access token, or a password, private key or passphrase typed by hand: enter them again (Create device waits for the access check). A Vault or environment reference is kept. Clone is left out when the tenant is at its Agent limit, just as Add is disabled there.

Delete​

Delete Device Process:

Remove a device from the platform with dependency checking:

  1. Navigate to the device detail view or use the Actions menu from the list
  2. Click the Actions menu
  3. Select Delete device
  4. A deletion modal appears with confirmation

Standard Deletion:

  • Confirm device name matches
  • Click Delete to proceed
  • Success notification confirms deletion
  • Redirect to device list view

Deletion with Dependencies:

If a device has active dependencies, an error modal displays:

Error Modal Contents:

  • A Cannot delete device heading
  • A short description explaining the device is in use
  • An actionable warning notification with title and message
  • A Go to routes button that navigates to the Quick Routes page

The modal does not enumerate the specific routes that depend on the device — use the Go to routes button to inspect and update them.

Dependency Resolution:

  1. Click Go to routes in the error modal to open the Quick Routes page
  2. Identify routes that reference the device and edit them to use a different device or delete the routes
  3. Retry device deletion after the dependencies are removed
warning

For Windows and Linux Agent devices, deleting the device does not uninstall the Agent from the endpoint. Use the Agent CLI to uninstall if needed.

Edit Mode Workflow​

Device detail tabs support inline editing with unsaved changes protection:

Enter Edit Mode:

  1. Navigate to editable tab (General Settings, Device Configuration, etc.)
  2. Click the tab's Manage button, labelled with the tab's name
  3. Form fields become editable
  4. Save changes and Cancel buttons appear

Make Changes:

  • Modify editable fields
  • Changes are not saved automatically
  • Form validation occurs on save

Save Changes:

  1. Click Save changes button
  2. System validates changes
  3. Success notification displays confirmation
  4. Edit mode exits
  5. Tab displays updated values

On a device assigned to a container Director, the tab that holds Port runs the same check as the creation wizard while it is edited, and shows its alerts under the field. Save changes stays disabled while an error is shown. An edit that changes neither the port nor the protocol and assigns no further Director shows warnings only, so a device that was already misconfigured can still be saved.

Cancel Changes:

  1. Click Cancel button
  2. Form reverts to original values
  3. Edit mode exits
  4. No changes are saved

Tab Navigation Protection:

Leaving a tab closes its editor, and the same rule applies to every device type, Windows and Linux Agents included. With nothing changed, edit mode exits and the tab that was clicked opens. When the tab holds unsaved changes, an Unsaved changes modal asks first, with the message "Your changes will be lost if you leave this tab without saving."

The modal's heading is "You have unsaved changes", and the tab stays selected until it is answered:

  • Continue editing - Closes the modal. The tab, the editor and the changes stay as they are
  • Discard changes - Drops the changes, closes the editor and opens the tab that was clicked

There is no third button. The X in the corner and the Escape key do the same as Continue editing.

On every device type, anything edited in the tab's form counts as a change, including a list-field row that is being filled in and has not been added. A value typed and then typed back still counts. On every device type except the Agents, when Save changes fails because a required field on another tab is empty, the page opens that tab itself, without asking, and keeps the editor and its changes.

On a Windows or Linux Agent device, and on an Oracle Solaris, AIX or macOS device, Enable device and Disable device in the Actions menu open the Device overview tab once the status has changed. If a tab holds unsaved changes at that moment, the same modal asks before the overview opens.

Notifications​

The Devices interface provides automatic notifications for all operations:

Success Notifications​

Success messages auto-dismiss after 10 seconds. These include confirmations for device creation, enabling, disabling, deletion, and configuration updates. Hover to pause the auto-close timer, or click X to dismiss manually.

Error Notifications​

Error notifications persist until manually dismissed. These include failures for enable, disable, delete, update operations, and Director requirement alerts for device creation. Review error details and take corrective action before dismissing.