Collector Pairing ​

Pairing links a collector to the appliance it reports to. It happens once, using a short-lived code you generate on the appliance, and after that the collector remembers the appliance and reconnects to it on its own.

The connection always runs one way: the collector dials out to the appliance. Nothing ever needs to reach the collector from outside its own network, which is what lets it run in a protected zone the appliance itself cannot reach into. Where a collector sits in each network layout — and the firewall rules that go with it — is covered in Deployment Options.

Getting a pairing code ​

Pairing codes come from the appliance, not from the collector.

  1. On the appliance's web interface, open Organization > Settings > Collectors and click Add collector.
  2. Give the collector a name and click Create collector.
  3. Pulse shows a Pair this collector dialog with everything the installer will ask for:
    • Collector address — the address to enter at the Appliance address step of the installer.
    • Pairing code, with an Expires time next to it. The code is single-use and valid for 30 minutes.
    • Appliance fingerprint — keep this for later; see Checking the fingerprint below.

Keep the dialog open, or note the values down, until you reach the matching steps in the installer.

Entering it during setup ​

In the installer, choose the Collector role, then work through disk, network and NTP as usual. At Appliance address, enter the address from the dialog. At Pairing code, enter the code exactly as shown — upper or lower case both work, and the dash is optional. A mistyped code is rejected on the spot, before you can move on to the confirm screen.

Pairing at first boot ​

The collector does not pair during the install itself — the live installer environment may not have the network settings the finished machine will end up with. Instead, pairing happens the first time the newly installed system boots: it connects out to the appliance address you gave it and presents the pairing code.

If the code has expired ​

A pairing code is only valid for 30 minutes. If more time passes before the collector's first boot — a slow install, a delayed reboot, hardware that takes a while to come up — the code no longer works, and the collector's status screen shows that the pairing code expired.

A fresh code comes from the same place as the first one: on the appliance, open Organization > Settings > Collectors, find the collector — it is listed as Waiting for first connection — and choose New pairing code….

Checking the fingerprint ​

Once paired, compare fingerprints to make sure the collector is talking to the appliance you think it is:

  • The collector's status screen shows the fingerprint it pinned when it paired.
  • The appliance's Organization > Settings > Collectors page shows the same fingerprint for that collector, formatted as uppercase hex in groups of four (for example A1B2 C3D4 ...).

They should match exactly. If they do not, do not trust the connection — contact support, or revoke and re-pair the collector.

Re-pairing a collector ​

Re-pairing replaces a collector's stored connection entirely — the credentials it presents to the appliance and the appliance fingerprint it has pinned — with a fresh set, the same way as an initial pairing. Do it from the collector's own console, on the collector-only Appliance Connection screen (right after SSH / SFTP access on the main menu).

Re-pair when:

  • The collector's status screen shows a certificate mismatch, rejected or revoked credentials, a rejected or expired pairing code, or a rejected proof of identity. From that screen, press p to jump straight into the re-pair form.
  • You deliberately want this collector to connect to a different appliance.

A fresh pairing code comes from the same place as the first one: on the appliance's web interface, open Organization > Settings > Collectors, find the collector, and choose New pairing code… (see Getting a pairing code above for what that dialog shows).

On the Appliance Connection screen, press p for Re-pair, enter the address (prefilled with the one currently in use — change it too if you're pointing the collector at a different appliance) and the new code, then confirm. The screen warns that the current pairing will be replaced before it proceeds. Once confirmed, the collector discards its stored credentials and pinned fingerprint, saves the new address and code, and reconnects — pairing again exactly as it did on first boot.

Changing the appliance address ​

If an appliance moves to a new IP address or hostname and nothing else about it changes, use Change Address on the collector's Appliance Connection screen instead of re-pairing. Enter the new address; the collector's existing pairing and pinned appliance fingerprint are both kept, so no new pairing code is needed — the collector simply starts dialing the new address with the credentials it already trusts.

Restoring a backup before replacing an appliance ​

A backup taken after collectors were set up carries what a replacement appliance needs to keep them connected: the appliance's dedicated collector TLS key and the database's record of every paired collector. Restoring the database alone is not enough, though — the appliance's saved configuration, including that TLS key, has to come back too, or the replacement generates its own fresh key the first time it boots, and every already-paired collector rejects it as a certificate mismatch. Restoring configuration together with the database is not available from the guided List / Restore Backups screen today; contact support before bringing a replacement appliance online so collectors don't have to be re-paired.

Without a usable backup — or after a database-only restore — every collector shows a certificate-mismatch or rejected-credentials state on its own status screen and must be re-paired individually, with its data sources reassigned again in the web UI.