In Collector mode, LE collects logs from Windows machines remote to itself. In this mode, the Lasso Enterprise Service must be configured to run as a domain administrator account that has administrative rights on the remote hosts.

In Agent mode, Lasso is collecting its own event logs only. Therefore, the service can run as default LocalSystem.

One other difference is the Event Forwarder Protocol used to send log data to LogLogic LMI. There are two options: TCP syslog or UDP syslog.

In Agent mode, either transport option can be used.

In Collector mode, only TCP syslog should be used. If UDP syslog is used, then all hosts' logs that are collected and forwarded by the Collector will appear as coming from the Collector. In other words, individual host identification is lost.