What Is a Log Forwarder?

A Log Forwarder is a small agent you install directly on a server or workstation. Where a collector watches your network from the outside — polling and listening over the wire, agent-less — a forwarder sits on the machine itself and picks up what’s only visible from there: local log files, the operating system’s own logging service, host performance metrics, and Docker container data.

It’s entirely optional. Most of GridNMS works with no forwarder installed at all — devices, servers, and appliances are monitored over SNMP, SSH, syslog, and traps by your collectors. Install a forwarder on the specific hosts where you want that extra layer of detail.

Collector vs. forwarder

	Collector	Log Forwarder
Runs where	Once per site/network, watching many devices	On the individual host you install it on
Sees	What devices send it, or what it can reach over the network	What’s only visible locally on that host
Install	One per site	One per server/workstation you want it on
Connection	Outbound only, to GridNMS	Outbound only, to a collector

They work together: a forwarder never talks to GridNMS directly — it always ships everything to a collector on your network, the same collector that’s already watching the rest of your devices.

What it collects

• Log files — text logs written to disk, tailed as new lines are written.
• The system log — the systemd journal on Linux, or the unified log on macOS.
• Host performance metrics — CPU, memory, and disk (macOS and Linux).
• Docker container logs and stats — for hosts running containers (Linux).

Exactly what’s collected depends on the platform and how it’s configured — see What a forwarder collects, by platform and Forwarder Management.

Nothing to configure on the host after install

Once a forwarder is installed, everything else — which log sources are on, which host metrics ship, container settings — is configured centrally from GridNMS and pushed to the forwarder automatically. You don’t need to touch the host again to change what it collects.

Outbound-only and encrypted

A forwarder opens no network-reachable port on the host it runs on — every connection it makes is outbound, to a collector you name at install time. (It binds one loopback-only port for its own health metrics, which nothing off the host can reach.) Each forwarder is installed with a one-time access token from GridNMS, and uses it to send everything over an encrypted connection. See Installing a Log Forwarder for the full flow.

It’s also self-contained: installing a forwarder doesn’t download anything, and it never reaches out to the internet on its own.

Prefer not to install anything?

For basic reachability, CPU, memory, and disk on a server, GridNMS can also monitor it agent-less over SSH with a read-only account — see Server & Endpoint Monitoring. A Log Forwarder is for when you want more than that: specific log files, container visibility, or a host where SSH access isn’t an option.

Next steps

• Installing a Log Forwarder — Linux, macOS, and Windows.
• Forwarder Management — Groups, Profiles, and what each collects.
• Monitoring Your Forwarders — status, delivery, and troubleshooting.