Before installing a Collector, verify that your intended host machine and network meet the following requirements.
General Requirements and Recommendations
Consider the following before choosing a Collector host:
- DO NOT install a Collector on a host that already runs a Security Console or Scan Engine.
- Security Consoles and Scan Engines will not function properly if a Collector is present on the same host.
- Only install one Collector per machine, whether physical or virtual.
- Additionally, Rapid7 recommends that the host be entirely dedicated to the Collector’s use to maximize resource availability.
- Your Collector host must be configured with a Fully Qualified Domain Name (FQDN).
Hardware Requirements and Recommendations
You can install a Collector on a network server or virtual machine that meets the following minimum hardware requirements:
- 2 CPU cores with 2GHz+ on each core
- 8 GB RAM
- 60 GB available disk space
For optimal performance, Rapid7 recommends the following hardware specifications:
Number of Agents
Recommended CPU Cores
Recommended Disk Space*
Up to 500
Up to 2,400
Up to 600 per CPU core**
* Disk Space
In cases where a connection to the Insight Platform is interrupted or lost, the Collector will hold data in the form of logs written to the disk until a connection can be reestablished.
The more disk space a Collector has, the longer it can operate without a connection to the Insight Platform.
** CPU Cores
The Collector can only be responsible for 600 agents per CPU core. Mutlicore CPUs are recommended for taking on additional agents per Collector.
If your Collector CPU usage stays consistently above 40% under normal load, consider deploying an additional Collector.
Supported Operating Systems
Your Collector host must run one of the following 64-bit operating systems:
- Ubuntu 11.04 - 17.04
- Ubuntu Linux 10.04 LTS
- Debian 7.0 - 8.2
- CentOS 5.2 - 7.3
- Oracle Enterprise Linux (OEL) 5.2 - 7.3
- Fedora 17 - 25
- SUSE Linux Enterprise Server (SLES) 11 -12
- SUSE Linux Enterprise Desktop (SLED) 11 -12
- openSUSE LEAP (42.1 - 42.2)
- Amazon Linux
- Red Hat Enterprise Linux (RHEL) 5.2 - 7.3
- Microsoft Windows Server 2016
- Microsoft Windows Server 2012 R2
- Microsoft Windows Server 2008 R2
- Windows 7 and newer
You need to access your InsightVM web interface in order to retrieve the installer and complete the activation process. To do so, use either of the following supported web browsers:
- Mozilla Firefox (latest stable version)
- Google Chrome (latest stable version)
Implementing Collectors for the InsightVM use case requires the following connectivity.
Collector communication with Insight Agents
Since InsightVM implements Collectors as intermediaries between your deployed Insight Agents and the Insight Platform, your Collectors must allow different kinds of traffic from your agents on the following ports:
|Agent communication to Collector||Inbound||5508|
|Agent update requests to Collector||Inbound||6608|
|Agent file upload to Collector||Inbound||8037|
Collector communication with the Insight Platform
All Collectors must be able to establish outbound connectivity on port
*.endpoint.ingress.rapid7.com and communicate with the domains shown in the Data and Storage (S3) columns of the following table according to your geographic region. For example, for InsightVM subscribers that elect to store their data in Australia, Collectors must be able to communicate with the following endpoints using port
|Region||Data endpoint||Storage (S3 endpoint)|
If you intend to deploy token-based Insight Agents through your Collectors, you also need to allow outbound connectivity from each Collector on port
443 to the endpoint that provides the agent's configuration files. Just like the Data and Storage endpoints in the previous table, you can configure your firewall rules to allow your Collectors to connect to a region-specific version of the Deployment endpoint to meet this requirement:
Collector communication for InsightVM-specific data
Finally, your Collectors must be able to reach out on port
443 and communicate with one of the following InsightVM-specific endpoints according to your geographic region. This endpoint is responsible for displaying your vulnerability assessment data and powers several InsightVM features:
Firewall rule alternatives
If you need an alternative to the URL firewall rule configuration method shown here, see the Insight Agent Networking page for a table of IP addresses by region that you can use instead.