Read only agent / collector
I know I've brought this up before, but I'd like to bring it up again. LM's requirement that collectors run as local admins (or system) is a GAPING security hole in your product. No amount of cer...
Forum Discussion
Hi Eric -
LogicMonitor supports running your Windows Collectors however you like. The only requirement -- imposed by Windows -- is that it have sufficient permissions to poll WMI data on the devices to which it's assigned. To do so, the Collector needs to either be running as an account with permission to access WMI services on the target hosts, or be provided with credentials of an account with such access. Although many of our customers prefer to run their Windows Collectors as a local admin or system account, LogicMonitor does not require that they're configured in this way.
If you prefer to install a Collector in a per-host "agent" model, that's absolutely fine with us. In fact, we've provided APIs that make it easy for you to do so using automation/orchestration tools. See https://www.logicmonitor.com/support/rest-api-developers-guide/collectors/add-a-collector/ for details.
Regardless of your preferred Collector deployment model, as a security best-practice we recommend the use of role-based access control to limit access to Collector and LogicModule Management to a minimal number of individuals. This ensure that only those you've authorized have remote access to your Collector environment.
