Skip to main content

Install the Praxis collector on Windows

Install praxis-collector on Windows Server or Windows desktop/VM when you need on-box collection (for example Windows Event Log, file paths, or OTLP from other software on the host) without Kubernetes. The service registers with Praxis over OpAMP and runs the pipeline you published for that instance.

Before you begin​

  • Supported OS — Windows Server 2008 R2 SP1 / Windows 7 SP1 and later, on 64-bit (x64). The installer auto-selects a legacy build for Windows Server 2012 R2 and earlier. See Supported Windows versions for the full matrix.
  • Prerequisites — An OpAMP WebSocket URL (wss://.../v1/opamp or ws://... only in controlled networks), OAuth2 client key and secret for the collector, org id, tenant id, and pipeline id. Praxis provides these when you add a Windows collector or download install instructions.
  • Privileges — Installation usually requires an Administrator context. The collector service account must be able to read the event channels, folders, and network paths your sources require.
  • Network — Allow outbound HTTPS to Praxis (token endpoint) and WSS to the OpAMP path, plus connectivity to your export destinations (for example SecOps or object storage) per your pipeline.

Supported Windows versions​

praxis-collector ships two 64-bit (x64) MSI builds. The install command picks the right one automatically from the host's Windows version — newer Windows uses the standard MSI, and Windows Server 2012 R2 and earlier use a legacy MSI.

Windows versionSupport
Windows 10 (1809+) and Windows 11Supported
Windows Server 2016 / 2019 / 2022 / 2025Supported
Windows Server 2012 R2 / 2012, Windows 8.1 / 8Supported (legacy build)
Windows Server 2008 R2 SP1, Windows 7 SP1Supported (legacy build)
Windows Server 2008 (RTM) / Windows Vista and olderNot supported
ArchitectureSupport
x64 (64-bit Intel/AMD)Supported — shipped MSI (standard and legacy)
ARM64 (64-bit ARM)Supported — source build, no shipped MSI
x86 (32-bit Intel/AMD)No shipped MSI
ARM (32-bit)Not supported
note

The install command selects the build automatically from the OS version, so you copy a single command regardless of Windows release. On a stock Windows Server 2008 R2 that cannot negotiate TLS 1.2, the download from the artifact host fails until a current TLS 1.2 update (for example KB3140245) is installed.

Install​

Praxis generates a ready-to-run PowerShell command for your collector (under Add collector → Windows), with your OpAMP URL, org, tenant, pipeline, and credentials filled in. Run it from an elevated PowerShell.

The command bootstraps windows_install.ps1, which auto-detects the Windows version and downloads the matching MSI, verifies its SHA-256 checksum, enables TLS 1.2 for the artifact host, then installs silently. It accepts:

  • -Version (default latest) — append e.g. -Version 1.2.3 to pin a specific release.
  • -HttpsProxy / -NoProxy — for proxied hosts.

A representative shape (use the exact command Praxis shows you):

& ([scriptblock]::Create((Invoke-RestMethod "https://<artifact-host>/windows_install.ps1"))) `
    -Url "wss://<praxis-host>/v1/opamp" `
    -Key "<oauth2-client-key>" -Secret "<oauth2-client-secret>" `
    -Org "<org-id>" -Tenant "<tenant-id>" -Pipeline "<pipeline-id>"

Manual MSI install​

To install from a pre-downloaded MSI (air-gapped or offline), run msiexec directly — use the _legacy MSI on Windows Server 2012 R2 and earlier:

msiexec /i praxis-collector_<version>_windows_amd64.msi /quiet ^
  OPAMPURL="wss://<praxis-host>/v1/opamp" ^
  KEY="<oauth2-client-key>" SECRETKEY="<oauth2-client-secret>" ^
  ORG="<org-id>" TENANT="<tenant-id>" PIPELINE="<pipeline-id>"
caution

Treat KEY and SECRETKEY as secrets. Prefer deployment tooling that stores them in a secure store or scoping the MSI with short-lived, machine-locked values rather than long-lived secrets in plain scripts in shared tickets.

After install​

  • Open Services (services.msc) and confirm the Praxis collector (or product-named) service is Running.
  • In Event Viewer or the collector’s log file path (per your build), look for a successful OpAMP connection to Praxis.
  • Verify the collector appears online in Praxis and the correct pipeline is attached.

Install behind a corporate proxy​

The install command uses System.Net.WebClient, which honors the host's system/WinINet proxy automatically — on a machine that already has a proxy configured, the standard command works with no extra flags.

To route the install through a specific proxy (and configure that same proxy on the installed service in one step), set the proxy for the bootstrap download, then pass -HttpsProxy/-NoProxy to the script. Run from an elevated PowerShell:

$proxy = "http://proxy.corp.local:3128"   # add user:pass@ before the host if the proxy requires auth

# 1) Route the bootstrap download of windows_install.ps1 through the proxy, and
#    enable TLS 1.2 for the artifact host.
[Net.WebRequest]::DefaultWebProxy = New-Object Net.WebProxy($proxy, $true)
[Net.ServicePointManager]::SecurityProtocol = `
    [Net.ServicePointManager]::SecurityProtocol -bor 3072 -bor 768

# 2) Run the installer through the same proxy.
& ([scriptblock]::Create((Invoke-RestMethod "https://<artifact-host>/windows_install.ps1"))) `
    -Url "wss://<praxis-host>/v1/opamp" `
    -Key "<oauth2-client-key>" -Secret "<oauth2-client-secret>" `
    -Org "<org-id>" -Tenant "<tenant-id>" -Pipeline "<pipeline-id>" `
    -HttpsProxy $proxy `
    -NoProxy "localhost,127.0.0.1,169.254.169.254"

-HttpsProxy routes both the MSI download (and its checksum) and the installed service's OpAMP/exporter traffic through the proxy; -NoProxy becomes the service's bypass list. For an auth-required proxy, embed credentials in the URL (http://user:[email protected]:3128) and URL-encode any special characters; domain-joined hosts behind an integrated-auth (NTLM/Negotiate) proxy need no credentials.

note

The -HttpsProxy/-NoProxy you pass at install time are written to the praxis-collector service so its OpAMP and exporter traffic use the proxy too. To change the service proxy later without reinstalling, use the configure-proxy.ps1 helper or the per-service registry value described in Behind an HTTP/HTTPS Proxy.

Behind an HTTP/HTTPS Proxy​

If the host's egress to Praxis or to your destinations must traverse a corporate proxy, configure the collector with the standard HTTP proxy environment variables — HTTPS_PROXY, HTTP_PROXY, and NO_PROXY. Apply them on the praxis-collector Windows service and restart it.

The collector ships a configure-proxy.ps1 helper that writes the per-service Environment registry value and restarts the service. Run it from an elevated PowerShell after the MSI install completes:

& " C:\Program Files\Netenrich\PraxisCollector\configure-proxy.ps1" `
    -HttpsProxy "http://proxy.corp.local:3128" `
    -NoProxy    "localhost,127.0.0.1,.corp.local,169.254.169.254"

Run with no parameters to remove a previously configured proxy. See Get-Help configure-proxy.ps1 -Full for all options (including -NoRestart and -ServiceName).

Per-service environment (manual)​

Run an elevated PowerShell. The Environment value under the service's registry key is a REG_MULTI_SZ with one KEY=VALUE per line; Windows merges it into the service's process environment on start.

$svc = "praxis-collector"

$envValues = @(
    "HTTPS_PROXY=http://proxy.corp.local:3128",
    "HTTP_PROXY=http://proxy.corp.local:3128",
    "NO_PROXY=localhost,127.0.0.1,.corp.local,169.254.169.254"
)

New-ItemProperty `
    -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" `
    -Name "Environment" `
    -PropertyType MultiString `
    -Value $envValues `
    -Force

Restart-Service $svc

Machine-wide environment (alternative)​

If every service on the host should use the proxy:

[Environment]::SetEnvironmentVariable("HTTPS_PROXY","http://proxy.corp.local:3128","Machine")
[Environment]::SetEnvironmentVariable("HTTP_PROXY","http://proxy.corp.local:3128","Machine")
[Environment]::SetEnvironmentVariable("NO_PROXY","localhost,127.0.0.1,.corp.local","Machine")
Restart-Service praxis-collector

NO_PROXY checklist​

Always include localhost, 127.0.0.1, 169.254.169.254 (cloud instance metadata, where applicable), and the internal hostnames/CIDRs of any LAN log sources (for example Windows Event Forwarding collectors or on-prem SIEM receivers) the collector connects to.

Auth-required proxies​

Use HTTPS_PROXY=http://user:[email protected]:3128. URL-encode any special characters in the password.

TLS-inspecting (MITM) proxies​

Import the corporate root CA into LocalMachine\Root so outbound TLS handshakes validate:

Import-Certificate -FilePath corp-root-ca.cer `
                   -CertStoreLocation Cert:\LocalMachine\Root
Restart-Service praxis-collector
note

All outbound paths honor the standard proxy env vars, including the OpAMP WebSocket (collector ↔ Praxis), the OAuth2 token endpoint, the Google SecOps HTTP and gRPC exporters, Splunk HEC, Snowflake, M365, the GitHub receiver, and other confighttp-based exporters.

The Google SecOps gRPC path uses the gRPC client's built-in CONNECT tunneling, which inspects HTTPS_PROXY only — never HTTP_PROXY. Always set HTTPS_PROXY when proxying Chronicle gRPC traffic, even if you also set HTTP_PROXY for HTTP-based exporters.

Uninstall​

  • Use Settings → Apps → Installed apps and uninstall Praxis collector (or the name your MSI registers), or
  • Run the uninstall command Praxis shows you (alongside the collector's install instructions) from an elevated PowerShell. It bootstraps windows_uninstall.ps1, which stops and removes the service, the Add/Remove Programs registration, and the install/data directories:
& {
  $u = "https://<artifact-host>/windows_uninstall.ps1"
  [Net.ServicePointManager]::SecurityProtocol = `
    [Net.ServicePointManager]::SecurityProtocol -bor 3072 -bor 768   # TLS 1.2
  if (Get-Command Invoke-RestMethod -ErrorAction SilentlyContinue) {
    Invoke-Expression (Invoke-RestMethod $u)
  } else {
    Invoke-Expression ((New-Object Net.WebClient).DownloadString($u))
  }
}