Client

These profiles only exist on the client. You can see those in the debug server by adding the --debug flag (you can also add the --debug_port flag to set a different port). The client will by default serve the debug server over http://localhost:6060/.

• Monitoring

The client monitoring profile shows current information on the client event monitoring subsystem.

Clients receive a Client Event Table update from the server, instructing them on a set of CLIENT_EVENT artifacts to run. The results from these artifacts are streamed back to the server in near-realtime.

Client event queries are stored in the client’s writeback file so they can start immediately as soon as the client boots, even if it is not connected to the server or offline. While offline the results are buffered locally to a file, and then synced with the server at the next opportunity.

• Flows

The Client Flows profile shows information about currently executing collections on the endpoint. It is most interesting to collect when another flow is executing on the endpoint.



The profile shows the progress of the collection on the endpoint:

1. The flow id is used to identify the flow.
2. The duration of the collection since it was last started
3. How many bytes were uploaded to the server?
4. How many rows were returned to the server?

These are generally the same stats the server keeps but are from the point of view of the client.