Skip to main content
Collectors are optional data retrievers and event section producers used during event collection. They are responsible for handling specific data types (e.g., skb) or logical parts of the networking stack (e.g., conntrack).

​
How Collectors Work

Collectors operate during the collect command phase. When you run retis collect, collectors:
  • Install probes at strategic points in the kernel (some collectors)
  • Gather data when those probes are triggered
  • Generate structured event sections with the collected information
The skb collector, for example, doesn’t install probes itself. Instead, it gathers data whenever an skb (socket buffer) is available in probe arguments. If you add a probe on kfree_skb_reason, the skb collector automatically extracts data from the skb argument.
If no collector is explicitly enabled, Retis will try to load all collectors if their individual requirements are met (e.g., the ovs collector requires the OpenVSwitch kernel module to be loaded).

​
Selecting Collectors

You can control which collectors to use with the --collectors argument: 
# Auto-load all available collectors
$ retis collect
Collector(s) started: skb-tracking, skb, skb-drop, ovs, nft, ct

# Explicitly select specific collectors
$ retis collect -c skb,skb-drop
4 probe(s) loaded
When collectors are explicitly requested, they become mandatory and Retis will fail if prerequisites aren’t met. You can mix auto with explicit collectors: 
# Require skb collector, auto-load others
$ retis collect --collectors skb,auto

​
Available Collectors

skb

Extracts packet information from socket buffer structures

skb-tracking

Reports packet tracking IDs for flow reconstruction

skb-drop

Captures packet drop reasons from the kernel

ovs

Tracks packets through OpenVSwitch datapath

nft

Provides insights into Netfilter rules and verdicts

ct

Reports conntrack status and connection information

dev

Collects network device information

ns

Retrieves namespace information

​
Collector Summary

CollectorData CollectedInstalls ProbesEvent Section
skbPacket informationNoskb, packet
skb-dropDrop reasonYes (1)skb-drop
skb-trackingPacket tracking IDNo*skb-tracking
ovsOpenVSwitch dataYes (many)ovs
nftNftables contextYes (1)nft
ctConntrack infoNoct
devNet deviceNodev
nsNamespaceNonetns
*Probes for tracking packets are always installed by the Retis core.

​
Collector-Specific Options

Some collectors provide additional configuration options:

​
skb Collector

The --skb-sections option controls which parts of the socket buffer metadata to retrieve: 
$ retis collect -c skb --skb-sections meta,packet
See retis collect --help for all available sections.

​
nft Collector

The --nft-verdicts option filters which Netfilter verdicts to report: 
# Only report drops
$ retis collect -c nft --nft-verdicts drop

# Report drops and accepts (default)
$ retis collect -c nft --nft-verdicts drop,accept

​
ovs Collector

The --ovs-track flag enables USDT probes and packet tracking through OVS userspace: 
$ retis collect -c ovs --ovs-track
The --ovs-enrich-flows option queries the running OVS daemon for flow information: 
$ retis collect -c ovs --ovs-enrich-flows

​
Next Steps

Filtering

Learn how to filter events by packet content or metadata

Tracking

Understand how packet tracking works across the stack

Build docs developers (and LLMs) love

Get started for freeTalk to us