My OPSWAT Central Management can send diagnostic data — a fixed set of infrastructure health measurements — from your on-premises appliance to OPSWAT. This data helps OPSWAT support diagnose appliance health problems (CPU, memory, disk, service availability) and verify compatibility with the operating system you run. It consists of numeric measurements only: it never includes file contents, file names, scan results, or any data processed by the product.
Form factor | Operating system | Diagnostic data |
|---|---|---|
MSI installer | Windows | Supported |
RPM package | Linux | Supported |
OVA virtual appliance | Linux | Supported |
The same fixed metric set applies to every form factor; a measurement that does not apply to an operating system (for example, load average on Windows) is simply omitted.
Version requirement
Diagnostic data is available in My OPSWAT Central Management 10.7.26080 and later. On earlier versions the feature is not present and the Diagnostic Data tab does not appear under Settings → Servers.
Diagnostic data is strictly opt-in. Until an administrator enables it, the appliance neither collects nor transmits any of the measurements described on this page. If the telemetry configuration is invalid, the agent fails closed and sends nothing.
Enabling Diagnostic Data
Diagnostic data is off by default, and nothing is collected until an administrator opts in. There are two places to make that choice: during a Windows installation or upgrade, and at any time afterwards in the web console.
During installation or upgrade (Windows MSI)
On Windows, the setup wizard includes a Diagnostic data page. It appears when you install 10.7.26080 or later for the first time, and when you upgrade an appliance from a version earlier than 10.7.26080 — that is, the first time the feature reaches that appliance.
Leave Send diagnostic data to OPSWAT cleared to install without diagnostic data. This is the default.
Select it to opt in from first start.
Either choice can be changed at any time after installation from the web console. Later upgrades do not show this page again and do not change the preference already configured on the appliance.
The RPM package and the OVA virtual appliance do not present this choice during deployment. On those form factors, enable diagnostic data from the web console after the appliance is running.
In the web console
In the left navigation, go to Settings → Servers.
Open the Diagnostic Data tab.
Turn on the Send diagnostic data to OPSWAT toggle.
The setting applies immediately. Once the toggle is on, the appliance starts its 30-second collection and transmission cycle; when it is off, the appliance neither collects nor transmits any of the measurements described on this page, and nothing is queued for later upload.
If the Diagnostic Data tab is not present, the appliance is running a version earlier than 10.7.26080.
What is collected
A lightweight agent on the appliance samples the following categories every 30 seconds. The full list of individual metric names is available below for security review.
Category | What is measured |
|---|---|
System | How long the appliance has been running; the total number of running processes |
Processors | CPU busy percentage; number of logical processors; load average (Linux only) |
Memory | RAM in use and free, and the machine's total RAM |
Pagefile / swap | Pagefile or swap capacity, how much is in use, and paging activity |
Disk space | Capacity, used space, and percentage full — one row per fixed disk, under neutral names |
Disk activity | Total bytes and operations read/written across the host's disks |
Network | Total bytes, packets, dropped packets, and errors across the host's network interfaces; TCP connection counts by state |
MOCM services | For MOCM's own services only: whether each service is running and listening on its port, and its CPU, memory, and thread usage |
Telemetry self-health | Whether the diagnostic data itself is fresh, and bounded counters of collection errors |
System
Metric | What it measures | Availability |
|---|---|---|
| Time since the appliance last started | Windows & Linux |
| Total number of running processes | Windows & Linux |
Processors
Metric | What it measures | Availability |
|---|---|---|
| Fraction of CPU time in use | Windows & Linux |
| Number of logical processors | Windows & Linux |
| One-minute load average | Linux only |
| Five-minute load average | Linux only |
| Fifteen-minute load average | Linux only |
Memory
Metric | What it measures | Availability |
|---|---|---|
| RAM bytes in use and free | Windows & Linux |
| Fraction of RAM in use and free | Windows & Linux |
| Total RAM | Windows & Linux |
Pagefile / swap
Metric | What it measures | Availability |
|---|---|---|
| Pagefile/swap bytes in use and free | Windows & Linux |
| Fraction of pagefile/swap in use and free | Windows & Linux |
| Cumulative page-in and page-out operations | Windows & Linux |
| Cumulative page faults | Windows & Linux |
Disk space
Metric | What it measures | Availability |
|---|---|---|
| Bytes used and free per fixed disk | Windows & Linux |
| Capacity per fixed disk | Windows & Linux |
| Fraction used and free per fixed disk | Windows & Linux |
Disk activity
Metric | What it measures | Availability |
|---|---|---|
| Cumulative bytes read and written (host total) | Windows & Linux |
| Cumulative read and write operations (host total) | Windows & Linux |
| Cumulative time disks spent doing I/O (host total) | Windows & Linux |
| Cumulative time spent on read/write operations (host total) | Windows & Linux |
Network
Metric | What it measures | Availability |
|---|---|---|
| Cumulative bytes sent and received (host total) | Windows & Linux |
| Cumulative packets sent and received (host total) | Windows & Linux |
| Cumulative dropped packets (host total) | Windows & Linux |
| Cumulative send/receive errors (host total) | Windows & Linux |
| TCP connections by state (for example | Windows & Linux |
MOCM services — each value identifies only the MOCM service it belongs to, by its fixed product name
Metric | What it measures | Availability |
|---|---|---|
| Whether the service is running and listening on its port (1/0) | Windows & Linux |
| Number of running processes for the service | Windows & Linux |
| Number of processes the product expects for the service | Windows & Linux |
| The service's share of host CPU | Windows & Linux |
| The service's memory in bytes | Windows & Linux |
| The service's share of host memory | Windows & Linux |
| The service's thread count | Windows & Linux |
| Uptime of the service's youngest process | Windows & Linux |
| The service's open Windows handles | Windows only |
| The service's open file descriptors | Linux only |
| The service's cumulative disk I/O bytes | Windows & Linux |
| The service's cumulative page faults | Windows & Linux |
Service probes
Metric | What it measures | Availability |
|---|---|---|
| Result (1/0) of a fixed loopback HTTP health check of an MOCM service | Windows & Linux |
| Result (1/0) of a fixed loopback TCP connect check of an MOCM service | Windows & Linux |
Telemetry self-health
Metric | What it measures | Availability |
|---|---|---|
| Age of the most recent completed collection cycle | Windows & Linux |
| Count of collection failures, by a fixed category (never an error message) | Windows & Linux |
The agent enforces this list at the source: a measurement whose name or attribute is not on the approved list is dropped before it leaves the appliance, and a value that cannot be read is omitted rather than reported as zero or a made-up placeholder.
What is never collected
The following never leave the appliance, in any field of any measurement:
Host name, host ID, serial numbers, IP or MAC addresses, or cloud instance metadata
Process IDs, command lines, usernames, or executable paths
URLs, endpoints, port numbers, response bodies, or error message text
File contents, file names, scan results, credentials, or tokens
Custom folder paths, disk device identifiers, volume GUIDs, or network interface names
Any customer-entered free text
Disks are reported under neutral names (system, boot, data, vol0…vol7). A disk's location is included only when it carries no customer information: a Windows drive-letter root such as C: or D:, or a standard Linux mount point such as / or /var. A disk mounted at a custom path is reported under a neutral name only, and its path is never transmitted.
How data is identified and transmitted
Measurements are collected and transmitted every 30 seconds — the interval shipped with the product. Each transmission carries only the current values of the metrics listed above; nothing is queued for bulk upload later.
Each appliance is identified only by its deployment ID — the identifier already provisioned by the product. Nothing is derived from the host's hardware or name.
The operating system edition and version (for example Microsoft Windows Server 2022 Standard) are included so support can triage compatibility. They are read from the operating system's product string; if a value cannot be read it is omitted, never guessed.
Data is transmitted over TLS to the OPSWAT backend, using the forward proxy configured on the appliance when one is set. The destination is fixed product configuration and is not exposed for redirection in the console.
Diagnostic data is sent to activation.dl.opswat.com over TCP 443 — the same domain and port already required for license activation (see System Requirements). Existing enterprise allowlist rules for activation therefore cover telemetry traffic as well, so no additional firewall or proxy policy change is needed. Where the appliance reaches the internet through a configured forward proxy, telemetry follows that same proxy.