---
url: https://docs.realmsec.info/integration/collector-windows.md
---

# Installing Collector on Windows

Before starting, review the [Realm Collector overview](/integration/collector) for VM requirements, the outbound firewall allow-list, and Realm Console setup — you'll need the install token generated there.

## Step 1: Download & Run executable

1. Download the .exe
   https://gitlab.com/realm-security-public/collectors/-/releases\
   to a suitable temporary location, such as

```
C:\Users\Administrator\Downloads\realm-collector-amd64.exe
```

2. Open an Administrative terminal

* Open Start menu, search for "Terminal" (called "Windows PowerShell" or "Command Prompt" on older versions)
* Right click and choose "Run as Administrator"

3. Run the collector with the install token

```
cd Downloads
.\realm-collector-amd64.exe --config realm:<TOKEN>
```

At this point the collector is setup to run as a windows service.

### Optional: Use a custom storage location

By default, the collector stores its state and local disk buffer in `C:\ProgramData\realmsec`. To use a different location (for example, a larger data drive), set the `REALM_STORAGE_PATH` environment variable during install and on the Windows service. The commands below use PowerShell and must be run from the Administrative terminal.

1. Before running the installer in step 3 above, set the storage path in the current terminal session:

```powershell
$env:REALM_STORAGE_PATH = 'D:\realmsec'
.\realm-collector-amd64.exe --config realm:<TOKEN>
```

2. After the install completes, configure the same path on the Windows service:

```powershell
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\realm-collector' `
  -Name Environment -Type MultiString -Value 'REALM_STORAGE_PATH=D:\realmsec'
```

3. Restart the service so it picks up the new location:

```powershell
Restart-Service realm-collector
```

> **Note:** Replace `D:\realmsec` with your preferred path. The service runs as the Local System account, which must have write access to this folder. When upgrading the collector later, set `$env:REALM_STORAGE_PATH` in the terminal again before running the installer.

## Step 2: Update Host Firewall

1. Open Windows Defender Firewall with Advanced Security
2. Create an inbound “Program” rule

* Program: `%ProgramFiles%\realm-security\realm-collector.exe`
* Action: Allow the connection
* Profile: Domain / Private / Public
* Name: Realm Collector

3. If using hardware firewall appliance, open the necessary ports to the VM

* Required inbound ports are configurable in the Realm console
* Each syslog endpoint requires a unique port on the VM

## Troubleshooting

### Event Viewer tabs show an unhelpful error

Windows Event Viewer quirk: when viewing events, there's two tabs: "General" / "Details"
If the "General" tab shows an unhelpful error that's not from the collector itself, use the "Details" tab.
This likely happens until the first reboot after install.

e.g. same error in both tabs
![windows Event Viewer General](../images/collector-win-evt-general.png)
![windows Event Viewer Details](../images/collector-win-evt-details.png)

Similarly, you can add a filter for the realm-collector source, but it might not show up in the drop-down until reboot.&#xA;&#xA;

### Clean up the local disk buffer

Deleting the collector's local disk buffer is not required. If you choose to clear it:

1. Stop the Realm collector service.
2. Open the collector's local buffer folder: `C:\ProgramData\realmsec\buffer` (or the `buffer` folder under your custom storage location, if configured). It contains a single buffer file.
3. Delete the buffer file.
4. Restart the Realm collector service.

> **Note:** `C:\ProgramData` is hidden by default in Windows Explorer. If you can't find it, change the Windows Explorer settings to show hidden files. Enter `%ProgramData%` in the Explorer address bar in case the ProgramData folder is on a drive other than c:.

### Normal logging behavior

In terms of logging, the collector is very quiet by design, so typically once it starts it'll log a handful of messages and then be silent unless something goes wrong.

Realm-specific: logs metadata about the current config:
Loaded collector config	{"version": 5, "config_fetched_at": "2025-05-14T13:59:39.633Z"}The version is not visible in the product anywhere, but it something engineering can use for support purposes.

```
Everything is ready. Begin running and processing data.
```