Linux
- x86_64 (64-bit) only
- systemd required
- RHEL, Ubuntu, Debian, etc.
api.us.licenseware.io or api.au.licenseware.io instead — the agent follows the issuer in its enrolment token.LOG_SHIP_ENABLED). Regional tenants use pushlogs.us.licenseware.io or pushlogs.au.licenseware.io.objects.githubusercontent.com.Download the installer package for your operating system and architecture. Packages never contain an enrollment token — you supply it at install time.
.exe is deprecated and no longer published here. Use the .msi: it bundles osquery, installs the Windows service, and upgrades in place. Existing .exe installs keep updating themselves.x64 (64-bit)
Debian / Ubuntu · RHEL / Fedora / SUSE
The /d/latest/ links above always resolve to the current release. To pin a specific version, replace latest with the release tag, e.g. https://cdn.licenseware-collector.com/d/v1.2.3/…
⚠️ Requires root privileges
curl -fsSLO https://cdn.licenseware-collector.com/d/latest/licenseware-collector_amd64.debsudo apt install ./licenseware-collector_amd64.deb On RHEL / Fedora / SUSE use sudo dnf install ./licenseware-collector_amd64.rpm. Installing stages the service but does not start it — the next step does.
sudo TOKEN=<enrollment-token> licenseware-collector registerFor environments with a proxy or custom CA certificate, export the variables and pass them through to register with sudo -E:
export HTTPS_PROXY="http://proxy.corp.com:8080" # optional
export NO_PROXY="localhost,127.0.0.1" # optional
export CA_CERT_PATH=/etc/ssl/certs/corp-ca.pem # optional
sudo -E TOKEN=<enrollment-token> licenseware-collector registerOr pass the CA certificate as an explicit flag:
sudo TOKEN=<enrollment-token> licenseware-collector register \
--ca-cert /etc/ssl/certs/corp-ca.pem| Flag / Variable | Required | Description |
|---|---|---|
TOKEN | Yes | Enrollment token from the Licenseware platform, passed on the register command line. The aliases LICENSEWARE_ENROLL_TOKEN and ENROLL_TOKEN are also accepted. |
--ca-cert / CA_CERT_PATH | No | Path to PEM file with custom CA certificates (for on-prem / TLS inspection) |
--env-file | No | Path to a file with environment variables to load |
HTTPS_PROXY | No | HTTP(S) proxy for outbound traffic. Automatically saved to the service config. |
NO_PROXY | No | Comma-separated list of hosts to bypass the proxy |
⚠️ Requires root privileges
sudo installer -pkg LicensewareCollector.pkg -target /sudo TOKEN=<enrollment-token> \
/usr/local/licenseware-collector/seed/licenseware-collector register⚠️ Requires Administrator privileges
Invoke-WebRequest -Uri https://cdn.licenseware-collector.com/d/latest/LicensewareCollector.msi `
-OutFile LicensewareCollector.msimsiexec /i LicensewareCollector.msi TOKEN=<enrollment-token>.msi to upgrade in place.The install runs as SYSTEM and is fully unattended: msiexec /i LicensewareCollector.msi TOKEN=<enrollment-token> /qn /norestart. Enrolment happens synchronously inside the installer — nothing is deferred to a background task.
| Code | Meaning |
|---|---|
0 | Installer succeeded — see the caveat below |
3010 | Success, reboot pending (files in use; the package itself schedules no reboot) |
1603 | Install action failed, or a downgrade was blocked. The reason is in %ProgramData%\Licenseware\setup.log |
1618 | Another installation is already in progress |
1619 / 1620 | Package path unreachable, or not a valid installer package |
These are standard Windows Installer codes. There are no vendor-specific values.
Use a PowerShell detection script. Do not use a file-version rule: agents released before the 2026-08 build carry no version resource at all, so the comparison can never match. A product-code rule reports success even when enrolment did not complete.
$svc = Get-Service licenseware-collector -ErrorAction SilentlyContinue
$env = "$env:ProgramData\Licenseware\collector.env"
if ($svc -and (Test-Path $env) -and (Select-String -Path $env -Pattern '^TOKEN=..*' -Quiet)) {
Write-Output "Installed"
exit 0
}
exit 1The TOKEN= line is written only by a completed enrolment, and the Windows service is created only by register. Together they mean the agent is genuinely reporting in.
When enrolling manually (a tokenless MSI install), the token is supplied through the environment and the remaining options as flags:
$env:TOKEN = "<enrollment-token>"
& "$env:ProgramFiles\Licenseware\LicensewareCollector.exe" register `
--ca-cert <PATH> --env-file <PATH>| Flag | Env Variable | Required | Description |
|---|---|---|---|
TOKEN= (MSI property) | TOKEN | Yes | Enrollment token from the Licenseware platform. Pass TOKEN= to msiexec, or set TOKEN before running register manually. The older ENROLLTOKEN= property is still accepted. |
--ca-cert | CA_CERT_PATH | No | Path to PEM file with custom CA certificates (for on-prem / TLS inspection) |
--env-file, -e | — | No | Path to a file with environment variables to load |
| — | HTTPS_PROXY | No | HTTP(S) proxy for outbound traffic. Automatically saved to the service config. |
| — | NO_PROXY | No | Comma-separated list of hosts to bypass the proxy |
$env:HTTPS_PROXY = "http://proxy.corp.com:8080"
$env:NO_PROXY = "localhost,127.0.0.1"
$env:TOKEN = "<enrollment-token>"
& "$env:ProgramFiles\Licenseware\LicensewareCollector.exe" register `
--ca-cert "C:\certs\internal-ca.pem"If your network requires an HTTP proxy for outbound connections, the collector natively supports standard proxy environment variables for all egress traffic.
| Variable | Description | Example |
|---|---|---|
HTTPS_PROXY | Proxy for HTTPS traffic (used for all collector communication) | http://proxy.corp.com:8080 |
HTTP_PROXY | Proxy for plain HTTP traffic | http://proxy.corp.com:8080 |
NO_PROXY | Comma-separated list of hosts to bypass the proxy | localhost,127.0.0.1,.internal.corp |
Authenticated proxies are supported using the format http://user:password@proxy.corp.com:8080.
Add the proxy variables to the collector environment file on the target machine. Each line uses KEY=value format.
HTTPS_PROXY=http://proxy.corp.com:8080
NO_PROXY=localhost,127.0.0.1/etc/default/licenseware-collectorHTTPS_PROXY=http://proxy.corp.com:8080
NO_PROXY=localhost,127.0.0.1/usr/local/etc/licenseware-collectorHTTPS_PROXY=http://proxy.corp.com:8080
NO_PROXY=localhost,127.0.0.1C:\ProgramData\Licenseware\collector.envAfter modifying the environment file, restart the collector service for changes to take effect:
sudo systemctl restart licenseware-collector sudo launchctl kickstart -k system/io.licenseware.licenseware-collector Restart-Service licenseware-collector Corporate proxies that perform TLS inspection inject their own CA certificate into the chain. The collector must be configured to trust these certificates, otherwise all HTTPS connections will fail.
| Option | Description | Example |
|---|---|---|
CA_CERT_PATH | Environment variable pointing to a PEM file with additional CA certificates | /etc/ssl/corp-ca.pem |
--ca-cert | CLI flag (overrides CA_CERT_PATH when set) | --ca-cert /etc/ssl/corp-ca.pem |
Custom certificates are appended to the system certificate pool, not replacing it. All standard system CAs remain trusted.
Add the CA_CERT_PATH variable to the collector environment file, pointing to the PEM file containing your corporate CA certificate(s).
CA_CERT_PATH=/etc/ssl/certs/corp-ca.pem /etc/default/licenseware-collectorCA_CERT_PATH=/usr/local/etc/ssl/corp-ca.pem /usr/local/etc/licenseware-collectorCA_CERT_PATH=C:\ProgramData\Licenseware\corp-ca.pem C:\ProgramData\Licenseware\collector.envAfter modifying the environment file, restart the collector service for changes to take effect:
sudo systemctl restart licenseware-collector sudo launchctl kickstart -k system/io.licenseware.licenseware-collector Restart-Service licenseware-collector sudo apt remove licenseware-collector sudo dnf remove licenseware-collector Removing the package stops the service and runs the uninstaller for you. Do not call licenseware-collector uninstall directly on a package-managed host — it refuses and points you back at the package manager.
Download uninstall.command from the Downloads section and double-click it, or run it from Terminal:
sudo LICENSEWARE_UNINSTALL_FROM_PACKAGE=1 \
/usr/local/libexec/licenseware-collector/licenseware-collector uninstall --force
sudo rm -rf /usr/local/licenseware-collector
sudo pkgutil --forget io.licenseware.collectormsiexec /x LicensewareCollector.msiSettings > Apps > Installed apps --preserve-state; to also remove the bundled osquery, add --remove-osquery.All communication uses HTTPS with Bearer token authentication.
| Method | Endpoint | Purpose | Frequency |
|---|---|---|---|
| POST | /agent/register | Register agent | Once |
| GET | /agent/configs | Fetch configs | Every 30m |
| GET | /agent/catalogs | Get catalogs | Every 30m |
| POST | /agent/ingest | Upload data | Cyclical |
What You Do
What the Collector Does
Comprehensive system, hardware, and software inventory collection
| Data Collected | Linux | Windows | macOS |
|---|---|---|---|
| System Info (hostname, CPU, RAM) | ✓ | ✓ | ✓ |
| Installed Programs | ✓ | ✓ | ✓ |
Software usage patterns and execution history
| Data Collected | Linux | Windows | macOS |
|---|---|---|---|
| Execution History (Prefetch, BAM, Access Times) | ✓ | ✓ | ✓ |
Running processes, services, and active sessions
| Data Collected | Linux | Windows | macOS |
|---|---|---|---|
| Running Processes & Active Users | ✓ | ✓ | ✓ |
/usr/libexec/licenseware-collector/licenseware-collector /etc/systemd/system/licenseware-collector.service /etc/default/licenseware-collector %ProgramFiles%\Licenseware\LicensewareCollector.exe C:\ProgramData\Licenseware\bin\LicensewareCollector.exe C:\ProgramData\Licenseware\collector.env /usr/local/libexec/licenseware-collector/licenseware-collector /Library/LaunchDaemons/io.licenseware.licenseware-collector.plist /usr/local/etc/licenseware-collector TOKEN=<enrollment-token> licenseware-collector registerlicenseware-collector statuslicenseware-collector stoplicenseware-collector run-onceThe collector writes all logs to standard error. How you access them depends on the operating system and service manager.
The verbosity is controlled by the LOG_LEVEL environment variable in the collector environment file. The default is error.
| Level | Description |
|---|---|
debug | Most verbose — all messages including internal state |
info | Operational messages (startup, config reload, ingestion cycles) |
warn | Non-critical issues that may need attention |
error | Failures only (default) |
critical | Fatal errors that stop the service |
On systemd-based systems, logs are captured by the journal automatically.
journalctl -u licenseware-collector -f journalctl -u licenseware-collector --since "1 hour ago" The launchd service writes both stdout and stderr to a single log file.
tail -f /var/log/licenseware-collector.log cat /var/log/licenseware-collector.log The Windows service itself does not write application logs to a file or to the Windows Event Log. Use the commands below in an Administrator PowerShell to investigate the service: check its state, inspect service start/stop/crash records that Windows itself emits, and capture full application output by running the collector interactively.
licenseware-collector status Get-Service licenseware-collector | Format-List Name, Status, StartType, DisplayName sc.exe qc licenseware-collector ; sc.exe qfailure licenseware-collector Get-WinEvent -FilterHashtable @{
LogName = 'System'
StartTime = (Get-Date).AddDays(-1)
ProviderName = 'Service Control Manager'
} | Where-Object { $_.Message -match 'licenseware-collector' } |
Format-List TimeCreated, Id, LevelDisplayName, MessageGet-WinEvent -FilterHashtable @{
LogName = 'Application'
StartTime = (Get-Date).AddDays(-7)
} | Where-Object { $_.Message -match 'LicensewareCollector' } |
Format-List TimeCreated, ProviderName, Id, LevelDisplayName, Messageeventvwr.msc Stop-Service licenseware-collector
$env:LOG_LEVEL = 'debug'
licenseware-collector run-once --env-file C:\ProgramData\Licenseware\collector.env *>&1 |
Tee-Object -FilePath "$env:USERPROFILE\licenseware-collector-debug.log"
Start-Service licenseware-collector*>&1 redirection merges every PowerShell stream (stdout, stderr, warnings, verbose, debug) so nothing the collector writes is lost.licenseware-collector provider — stderr is not captured for services, so this is the primary source once the service is running:Get-WinEvent -ProviderName "licenseware-collector" -MaxEvents 50 msiexec /i LicensewareCollector.msi /l*v install.log
Get-Content install.log -Tail 200register printed, including the reason enrollment failed, and it survives the rollback that removes everything else. The enrollment token is never written to it:Get-Content C:\ProgramData\Licenseware\setup.log