Install the collector on Linux (x64, systemd)

Overview

The Linux package installs the collector as a systemd unit that starts on boot and restarts automatically if it exits unexpectedly.

Run the installer script

curl -fsSL https://dl.assuriq.io/collector/linux/install.sh | sudo sh

This installs the binary to /opt/assuriq/collector, writes the systemd unit, and enables it at boot. It does not enroll the collector — that is a separate, explicit step so the token is never embedded in a downloaded script.

Enroll the collector

assuriq-collector enroll --token <one-time-token> --url <control-plane-url>

The CLI exchanges the token for a permanent collector credential, stores it under a root-only file, and starts the service.

sudo systemctl enable --now assuriq-collector

Under the hood, enroll calls POST /api/v1/collectors/enroll with the token, hostname, OS and version; a successful response returns the collector's auth token and initial scan scopes. See the Collector API v1 reference for the exact request and response shapes.

• Collector API v1 reference
  Request/response shapes for the collector-facing API v1 endpoints: enroll, heartbeat and observations, plus tenant/site binding rules and error codes.
• What the v0.1 collector does today
  A plain list of what the native v0.1 collector supports right now versus what is designed but not yet active, and what the DEV build badge means.

Verify the service

systemctl status assuriq-collector

Expected state is active (running). Use journalctl for recent logs, and confirm the collector shows Healthy in the site's Collectors panel within about 60 seconds.

journalctl -u assuriq-collector -f

Uninstall

sudo systemctl disable --now assuriq-collector
sudo rm -rf /opt/assuriq/collector /etc/systemd/system/assuriq-collector.service
sudo systemctl daemon-reload

Revoke the collector's credential from AssurIQ afterward so it can no longer authenticate if the host or disk image is reused.

• Uninstall and revoke a collector
  How to retire a collector cleanly: uninstall the host software and revoke its credential so it cannot re-authenticate.

Troubleshooting

• AIQ-ENR-001Enrollment token invalid or already used
  The enrollment token was not recognized, or has already been exchanged for a credential.
• AIQ-ENR-004Control plane unreachable during enrollment
  The host could not complete the outbound HTTPS/mTLS handshake to the control plane.
• AIQ-COL-001Collector offline
  The collector has not sent a heartbeat within the expected interval. Discovery, scans and evidence collection for its sites are paused.

• Enrollment failures
  Symptom-first guide for AIQ-ENR-001 through AIQ-ENR-004: token, expiry, revocation and connectivity failures during enrollment.
• Firewall and egress requirements
  The collector is outbound-only. What to allow, on which ports, and why no inbound rules are ever needed.