Trait Collectors

Traits are auto-discovered facts about a managed machine (envoy). The Vigo agent ships 50 built-in trait collectors covering OS identity, hardware, network, installed and running packages, security posture, certificates, listening services, kernel module attestation, swarm participation, CVE × running-binary correlation, and agent/host resource pressure. Most run cross-platform on Linux, macOS, FreeBSD, OpenBSD, and NetBSD; eight are Linux-only (tpm, secureboot, package_source_audit, kernel_module_attestation, listeners, cve_running_correlation, host_self, hypervisor); 13 run on Windows. Traits are reported to the server on each check-in and are available in .vgo config files for when: conditional expressions and Go template rendering (via .Traits).

Each collector runs in parallel under a per-collector timeout (5s default; up to 30s for cve_running_correlation and 60s for security_scan). Failed collectors are logged and skipped without affecting other collectors. Collectors are classified as volatile (run every cycle: time, uptime, loadavg, mountpoints, filesystem, users, memory, swap, ports, swarm, swarm_seeds, gitback, puddle, agent_self, host_self), stable (cached across ~12 cycles: everything else), or periodic (cached across ~hourly intervals: package_updates, cloud, cve_running_correlation).

Trait Collectors

The trait paths and structure are identical across platforms so when: expressions and templates work without modification — each collector uses a platform-native implementation under the hood (for example, the os collector reads /etc/os-release on Linux, sw_vers on macOS, and sysctl kern.ostype on the BSDs).

Windows Trait Collectors (13)

| Filesystem | filesystem | Per-drive disk usage (total, used, free, percent) | filesystem_windows.md |

Connwaer Trait Collector

If the Connwaer compliance verification agent is installed alongside the Vigo agent, the connwaer trait collector reads Connwaer's JSON result files from disk and reports them under the connwaer trait namespace (see connwaer.md). Each capability's latest result (status, summary, evidence, controls) is available as .Traits.connwaer.<capability_name>. Results older than 24 hours are considered stale and excluded.

Network Device Traits

Network devices managed via the gateway proxy pattern have a dedicated trait collector that runs over SSH. These traits are reported under the device namespace.

Platform Implementation Details

The following collectors share the same trait path across all platforms but use platform-specific implementations: os, hardware, identity, memory, mountpoints, network, packages, processors, swap, timezone, uptime, users, filesystem.

The time collector uses a single cross-platform implementation. The dmi, cloud, and docker collectors are cross-platform but may return limited data on some platforms.

On macOS, platform-specific collectors use sysctl, sw_vers, system_profiler, and ifconfig. On FreeBSD, OpenBSD, and NetBSD, shared BSD collectors use sysctl, ifconfig, and /proc (where available). macOS has dedicated implementations for os, hardware, network, memory, and swap; FreeBSD, OpenBSD, and NetBSD each have a dedicated os collector and share BSD implementations for the rest.

The systemd and selinux collectors are Linux-specific and return null on macOS, BSD, and Windows. The following collectors are unavailable on Windows and return null: virtual, loadavg, kernel, blockdevices, systemd, selinux, locale, gpu.

Using Traits

In When Expressions

Traits power when: conditional expressions on resources. Built-in functions like os_family() and is_container evaluate trait data:

- name: install-nginx
  type: package
  package: nginx
  when: "os_family('debian')"

In Templates

Traits are available as .Traits in Go templates within content: attributes:

- name: motd
  type: file
  target_path: /etc/motd
  content: |
    Welcome to {{ .Traits.network.hostname }}
    OS: {{ .Traits.os.distro }} {{ .Traits.os.version }}
    CPUs: {{ .Traits.hardware.cpu_count }}
    Memory: {{ .Traits.hardware.memory_mb }} MB