> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux Collector

> What the Hilt DMG Collector is, what it observes, and how to navigate this guide.

This guide describes the Hilt Data Movement Governance Collector: what it is, what it observes, how it's deployed on Kubernetes nodes, plain Linux VMs, and AWS ECS Fargate tasks, and how it integrates with the Hilt data-plane you received separately.

> [!NOTE]
>
> In file paths, service names, and environment variables you may see the prefix `dag` (e.g. `dag-agent`, `DAG_SHIP_URL`). This is the internal codename of Hilt's telemetry engine and is functionally equivalent to "Hilt Collector" throughout this documentation.

A shorter quick-start also ships with every release tarball at `docs/client-deployment-guide.md` (and is uploaded as `README.md` per version); this guide is the long-form companion.

## What is a collector

The collector is a single static Linux binary (\~5 MB, zero dependencies) plus an eBPF program that the binary loads into the kernel at startup. It attaches tracepoints to a narrow set of kernel entry points, derives an identity-aware event stream from them, filters out high-volume noise in userspace, and ships the results to your Hilt ingest endpoint. The program attaches to syscalls and kernel hooks to capture process execution, file operations, and network events.

## What the collector does *not* do

The DMG Collector is strictly observational. It does **not**:

* **Expose network services.** The agent only makes outbound HTTPS to your control plane defined as `DAG_SHIP_URL`. Nothing else opens a socket.
* **Install kernel modules.** Everything rides eBPF (CO-RE with native or bundled BTF, depending on kernel version); there is no out-of-tree driver, no DKMS, no custom kernel build.
* **Modify network traffic.** The agent observes; it never injects, drops, blocks, or alters packets. Quarantine (where used) is a separate control-plane action via AWS security groups, executed by the dashboard, not by the agent.
* **Change host state.** No system modifications are made, aside from optionally writing a configuration file.
* **Perform external callbacks.** No license checks, telemetry beacons, or "phone-home" behavior. The only outbound communication is the configured event stream.

## In this guide

* [System requirements](https://hilt.ai/docs/linux-collector/system-requirements.md)
* [Release artifacts](https://hilt.ai/docs/linux-collector/release-artifacts.md)
* [Deploy on Kubernetes](https://hilt.ai/docs/linux-collector/deploy-kubernetes.md)
* [Deploy on VMs](https://hilt.ai/docs/linux-collector/deploy-vms.md)
* [Deploy on ECS Fargate](https://hilt.ai/docs/linux-collector/deploy-fargate.md)
* [Configuration reference](https://hilt.ai/docs/linux-collector/configuration.md)
* [Networking and security](https://hilt.ai/docs/linux-collector/networking-security.md)
* [Event data model](https://hilt.ai/docs/linux-collector/event-data-model.md)
* [Sizing and capacity](https://hilt.ai/docs/linux-collector/sizing-capacity.md)
* [End-to-end data flow](https://hilt.ai/docs/linux-collector/data-flow.md)
* [Agent filtering](https://hilt.ai/docs/linux-collector/agent-filtering.md)
* [Troubleshooting](https://hilt.ai/docs/linux-collector/troubleshooting.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.