Skip to main content

​
File locations

Beacon manages different paths depending on whether you install in user mode or system mode. The active runtime log stays at runtime.jsonl and rotates at 10 MiB, retaining five numbered local archives by default. On Windows the system log directory sits under the base directory rather than in a separate location, because there is no /var/log equivalent. %ProgramData% and %ProgramFiles% are read from the environment rather than hardcoded, so a relocated or localized install is found rather than missed.

​
Service definitions

The collector runs under whichever service manager the host provides. On Linux, Beacon picks it by looking at what is actually running as PID 1, not at which tools are installed, so a container with systemctl on PATH but no systemd still gets the supervised fallback. The Beacon forwarder started by beacon endpoint connect is a second, resident service that runs Vector: /Library/LaunchDaemons/com.beacon.endpoint.asymptote-forwarder.plist or ~/Library/LaunchAgents/com.beacon.endpoint.asymptote-forwarder.plist on macOS, /etc/systemd/system/beacon-asymptote-forwarder.service or ~/.config/systemd/user/beacon-asymptote-forwarder.service on Linux. It is not offered in supervised mode, because nothing would restart it; run the Beacon pack under your own supervisor there. The scheduled inventory job is a third, one-shot unit that beacon endpoint install writes in both modes and the package postinstall reconciles on every upgrade: /Library/LaunchDaemons/com.beacon.endpoint.inventory.plist or ~/Library/LaunchAgents/com.beacon.endpoint.inventory.plist on macOS, beacon-inventory.timer plus beacon-inventory.service under /etc/systemd/system or ~/.config/systemd/user on Linux. It writes inventory_state.jsonl and its inventory-state.json state file beside the runtime log. Like the forwarder it is not offered in supervised mode; run beacon endpoint inventory heartbeat --scheduled from your own scheduler there. Windows has no unit file to point at: the service definition lives in the registry, so that is what beacon endpoint status reports where the other platforms report a path. And there is no counterpart to systemctl --user or launchd’s per-user domain, so a Windows user-mode install always gets the supervised collector. See Windows install. A supervised collector is a plain background process tracked by a pidfile. It works, but nothing restarts it if it exits or when the machine reboots. beacon endpoint status says so explicitly rather than reporting the same health as a real service. Hooks, plugins, and extensions install an embedded beacon-hooks adapter under the Beacon endpoint base directory. Hook and plugin configuration is written to:

Endpoint telemetry

Configure the local endpoint agent and harnesses.

beacon endpoint

Review endpoint command behavior and common paths.