Retire and revoke

Retiring a collector ends its service in Nexus Telemetry Fleet. A collector that is still under control is decommissioned. A collector that is lost, stolen or no longer trusted is revoked. A collector reports one terminal, and the dashboard shows the collector’s actions on that terminal’s page. Both actions are on the page’s Admin view, in the Retire or block this collector card.

Users with the Owner, Admin or Operator role can run every action in the card. The move to another group requires the Owner or Admin role. A user with the Viewer role can only read it. See Users and roles for the roles. See Terminal settings for the Actions menu on the same view.

Retire or block this collector

The card has 2 actions for a collector in service, Decommission and Revoke, and Remove once it is retired. Each requires the collector’s hostname to be typed. For Decommission and Revoke the fleet server checks the typed name before it acts. A decommission is refused while one is already in progress.

Decommission

Decommission a collector that is still under control.

  1. Press Decommission in the card.
  2. Type the hostname the drawer shows.
  3. Press Decommission in the drawer.

An online collector deletes its enrolment, and the terminal is removed from the dashboard’s views. An offline collector stays decommissioning until it next connects, or until the Decommission timeout passes. The timeout is 10 minutes by default and is set under Settings, Terminals. The terminal’s record, readings and history are kept and marked decommissioned. The certificate is added to the deny-list with the reason decommissioned.

Revoke

Revoke a collector that is lost, stolen or no longer trusted.

  1. Press Revoke in the card.
  2. Type the hostname.
  3. Press Revoke in the drawer.

The collector’s connection drops and its state is revoked. The fleet server refuses every reconnection and never accepts the certificate again.

Remove

Remove deletes the record of a collector. It is available only for a decommissioned or revoked collector.

  1. Press Remove in the card.
  2. Type the hostname.
  3. Press Remove.

The collector, its readings and its event history are deleted. The certificate log and the deny-list entry are kept, so a revoked certificate can never be used again.

Re-admission

A collector that is offline when its certificate expires cannot reconnect. Re-admission returns it with its name and history.

  1. In the Certificate panel of the Admin view, press Re-admit this collector under Re-admit an expired collector. The dashboard generates a single-use enrolment token, valid for 24 hours, and writes it into a command.
  2. Copy the command for the host. There is one for a package install and one for Docker.
  3. Run it on the collector’s host.

The command sets NF_REENROL=1, so the collector enrols once with the token on its next start. The terminal returns to the dashboard with its name and history.

Group move

Moving a terminal to another group changes nothing on the collector.

  1. Open the Groups view and press Manage groups.
  2. Press Manage terminals on the row of the destination group.
  3. Tick the terminal and press Save changes.

The Group field on the terminal’s Admin view shows the new group. For a terminal in no group it shows Not in a group.

Fleet server move

  1. Decommission the collector on server A and wait until its state is decommissioned.
  2. Generate an enrolment token on server B with Add telemetry collector.
  3. Enrol the collector on server B, as its platform page describes.

Server B has no record of the collector, so the terminal appears there as new, with no history. The history stays on server A. The collector’s identity is unchanged, so enrolling it on server A again attaches it to its original record.

Factory reset

A factory reset deletes the collector’s readings and its identity, so it enrols as a new collector on any fleet server. Use it when the host is sold or repurposed.

bash
sudo nf-collector reset --keep-data=false

The command asks Continue? [y/N]. Answer y. --keep-data=false deletes the readings and the identity. Without it, nf-collector reset keeps both.

← Collector GPS Views and filters →