What is a data connector or log collector?¶

A data connector or log collector is the component that retrieves, receives or forwards events from a source system into another platform.

It may run on the source device, on a separate server, in the cloud or as part of a monitoring product.

Avoid this assumption: That the collector simply copies every event immediately and without alteration. That may not be true.

Collectors can read files, subscribe to event streams, receive network messages or call provider APIs. They may select particular event types, convert formats, batch records, compress data or add collection metadata.

The collector therefore affects coverage. If it was offline, misconfigured or unable to access a source, events may not reach the destination. Permissions may limit which logs it can collect. Network or storage problems may create gaps.

Some collectors acknowledge receipt and retry failures. Others use protocols that provide no guarantee of delivery. A collector may also buffer events locally and forward them later, creating a difference between event time and ingestion time.

Investigators should identify the source, connector, collection method and destination. Ask what event types were configured, what permissions were used and whether filters or rate limits applied.

Obtain health, error and status records for the collector where gaps matter. Establish whether it stored a local copy, retried failed transmissions and how long buffered data was retained.

Preserve relevant configuration and version information. A connector update may change field mappings or coverage during the period under investigation.

Operational takeaway¶

A data connector or log collector controls how events move from source to destination, so its configuration, permissions, health and delivery method directly affect what records are available.