2fa		two factor authentication

action.*	Server actions
actions		Agent actions

agent.conn	Agent connections (server side)
agent.policy	Agent policies (server side)
agent.tunnel	Agent tunnels

ai.anomaly	AI anomaly detection profiles
ai.assistant	AI assistant core (including prompt injection guard)
ai.messages	AI messages and user confirmation requests
ai.operator	AI operator instances (perpetual monitoring loops)
ai.prov.*	AI/LLM provider communication (openai, anthropic, mistral, ollama)
ai.provider	AI/LLM provider framework (common layer above ai.prov.*)
ai.skills	AI skill loading and management
ai.tasks	AI background tasks
ai.tools	AI assistant tools (server and agent side)

aix		AIX platform subagent messages

alarm.*		Alarm management

auth		Authentication

beacon		Beacon poller
bind9		Bind9 subagent messages
bizsvc		Business services
bizsvc.check	Business service check

chatbot		Chat bots

client.session	Client sessions

cloud.discovery	Cloud domain resource discovery and reconciliation

calltbl		Named call handler registration and invocation

cas		CAS
comm.*		Communications (in agent log)
comm.listener	All listeners
crash		Crash dump handler (Windows)

crypto.*	Encryption functions
crypto.cng	CNG engine
crypto.cert	Certificate related messages
crypto.crl	CRL

darwin		MacOS platform subagent messages
dbquery		DBquery subagent messages
dload			DLL/shared library load unload information

db.*		Database related
db.agent	Agent database
db.cache	Caching of DB tables on start-up
db.conn		DB connections
db.cpool	DB connection pool
db.drv.*        Database drivers related
db.drv.mariadb  MariaDB driver
db.drv.mysql	MySQL driver
db.drv.oracle   Oracle driver
db.drv.pgsql	Postgresql driver
db.drv.sqlite	SQLite driver
db.query	SQL query trace

db.writer	DB background writers

dc.*            Data collection
dc.agent.cache	Agent side cache
dc.aggregation	DCI data aggregation (hourly/daily rollups)
dc.config	Data collection configuration
dc.modbus       Modbus data collection
dc.netconf      NETCONF data collection
dc.scheduler	Data collection scheduler
dc.snmp		Agent SNMP data collection
dc.summarytable Data collection summary tables

dload		Debug output of dynamic library loading functions

docker		Docker cloud connector

entsoe		ENTSO-E Transparency Platform subagent

event.*		Event related messages
event.corr	Event correlation
event.forwarder	Event forwarding framework (server side)
event.policy	Event processing policy
event.proc	Event processor
ext.provider	Agent external provider
extcheck	Agent external checks (Nagios-compatible monitoring plugins)
extension	Agent extensions (generic JSON-RPC protocol) — common
extension.*	Agent extensions — per-extension (extension.<name>)
exec		External function execution

fbdev		Framebuffer screenshot subagent

filemgr		File manager subagent
filemon		File monitoring
file.download	Server-side file download
file.upload	Server-side file upload
freebsd		FreeBSD platform subagent messages

geolocation	Geolocation (server side)
gps		GPS subagent

ha.lease	High availability cluster lease management

hdlink		Helpdesk link registration and dispatch
hdlink.jira	Jira helpdesk link module (including webhook)
hdlink.redmine	Redmine helpdesk link module

housekeeper	Housekeeper

image.library	Image library management and SVG sanitization

import.*	Server configuration import

init.*		Generic process or library initialization
init.curl	Curl initialization

java.*		Java components
java.bridge	Java bridge library
java.runtime	Java runtime

job.*		Server jobs related
job.manager	Job manager

housekeeper	Housekeeper messages

kpi		KPI engine (computation methods, sample attributes)

leef

linux		Linux platform subagent messages
lldpd		lldpd integration subagent messages

localadmin	Local administration interface
logs		Server log access
logwatch.*	Messages from log monitoring library

mcp		MCP endpoint module (AI function/skill registry access over MCP)

mobile		Mobile devices
modbus		Modbus cominication messages
modules		Server modules
mssql		MSSQL monitoring subagent messages
mysql		MySQL monitoring subagent messages

nc.*		Notification channels
		Level 4: throttling decisions (message throttled, digest triggered)
		Level 5: token bucket state changes, recipient bucket creation/cleanup
		Level 6: per-message throttle checks

ncd.*		Notification channel drivers
ncd.webhook	Generic webhook notification channel driver
ncd.xmpp	XMPP notification channel and chat bot driver

ndd.*           Network device drivers
ndd.arista	Arista EOS network device driver
ndd.bdcom	BDCOM network device driver
ndd.cambium	Cambium network device driver
ndd.common	Network device drivers common
ndd.hostmib	Hostmib related functionality
ndd.cisco	Cisco network device driver
ndd.cisco.c9800	Cisco-C9800 network device driver
ndd.cisco.sb	Cisco-SB network device driver
ndd.cisco.wlc	Cisco-WLC network device driver
ndd.dell.ftos	Dell Networking OS9 (Force10 / FTOS) network device driver
ndd.dell.os10	Dell EMC Networking OS10 network device driver
ndd.etherwan	EtherWAN network device driver
ndd.h3c		H3C network device driver
ndd.hpe.aoscx	HPE Aruba CX (AOS-CX) network device driver
ndd.hpe.hpsw	HPE switch network device driver
ndd.huawei.optix	Huawei OptiX network device driver
ndd.lenovo.flex	Lenovo Flex System Fabric network device driver
ndd.mellanox	Mellanox Onyx network device driver
ndd.mikrotik    Mikrotik network device driver
ndd.moxa.edr    MOXA-EDR network device driver
ndd.net-snmp	net-snmp network device driver
ndd.qtech	Qtech network device driver
ndd.saf		SAF network device driver
ndd.westerstrand        Westerstrand network device driver

netconf		NETCONF subagent and protocol support library

netsvc		Netsvc subagent

node.agent	Node agent (connections, etc.)
node.iface      Node interfaces (creation, deletion, etc.)
node.poller	Node poller
notification	Server notifications

npe.*		Prediction engines
npe.tsre	Time series regression engine

ntcb		NTCB module
ntcb.session	NTCB module sessions

ntopng		ntopng traffic connector

nxsagent	Session agent (nxsagent)

nxsl.alarm	NXSL Alarm class method failures
nxsl.http	NXSL HTTP client classes (HttpRequest, HttpSession)
nxsl.security	NXSL security context access validation
nxsl.ssh	NXSL SSH session operations
nxsl.tunnel	NXSL Tunnel class method failures

nxcp.streamcomp	NXCP stream compression

otel.log	OpenTelemetry log processing (server side)
otlp		OTLP receiver module
otlp.export	OTLP event forwarder (events exported as OTLP logs)
otlp.metrics	OTLP metric export (DCI values exported as OTLP metrics)

oxidized	Oxidized integration module

obj.*		Object related
obj.attr	Object custom attributes
obj.condition   Condition objects
obj.dc.*	Data collection related
obj.lifecycle	Object lifecycle related
obj.locks.*	Locks
obj.macro	Object macro expansion parameters
obj.maint	Object maintenance related
obj.netmap	Network maps
obj.poll.node	New node poll
obj.query       Object queries
obj.relations	Object relation related
obj.sync	Object synchronization

otlp		OpenTelemetry OTLP metrics receiver, node matching, and instance discovery

pdsdrv.*	Performance data storage drivers
pdsdrv.influxdb	InfluxDB performance data storage driver

ping		Ping subagent

policy		Agent policy (agent side)

poll.*		Polling
poll.autobind	Autobind poll
poll.conf	Configuration poll
poll.discovery	Network discovery
poll.icmp	ICMP poll
poll.manager	Polling manager
poll.node	New node poll
poll.routes	Routing table poll
poll.status	Status poll
poll.topology	Topology poll

portcheck	Portcheck subagent messages

prometheus	Prometheus subagent

proc.*		Process related trace
proc.spexec	Sub-process executor
procexec	Process executor

proxy		Proxy related (in agent log)

radius		Radius authentication
reporting	Reporting

sa.asterisk	Asterisk subagent
sa.pgsql	Postgres subagent
sa.wineventsync	Wineventsync subagent

scheduler	Scheduler
scripts.*	Script library related messages
scripts.scheduled	Scheduled script execution

shutdown	Server shutdown

smartctl		SMARTCTL related messages
smbios		SMBIOS related messages

snmp.*		SNMP related messages
snmp.discovery	SNMP discovery related
snmp.entity	Entity MIB processing
snmp.lib	SNMP library low-level diagnostic
snmp.proxy	SNMP proxy related
snmp.table	SNMP table DCI data collection
snmp.trap	SNMP trap processing
snmp.trap.flood	SNMP trap flood detection
ssh		SSH subagent
ssh.channel	SSH interactive channel (server-side)

startup		Server startup
statcoll	Internal server statistic collector

subagents	Sub-agent manager
sunos		SunOS subagent

sync		Syncer messages

syslog		Syslog server related messages
syslog.tls	Syslog over TLS listener

threads.*	Thread related
threads.pool	Thread pool related

traffic.connector	Traffic connector registration and interface calls
traffic.poll	Traffic observer polls and observation point discovery
traffic.sync	Configuration sync to traffic analyzers (host aliases)

topology.*	Topology related
topology.arp	ARP topology
topology.cdp	CDP topology
topology.conn_history	Connection history tracking
topology.fdb	Forwarding database topology
topology.ipv4	IPv4 topology
topology.layer2 Layer 2 topology builder
topology.lldp	LLDP topology
topology.ndp	NDP topology
topology.ospf	OSPF topology
topology.stp	STP topology

tunnel		Tunnel (in agent log)

tuxedo		Tuxedo subagent messages

upgrade		Agent upgrade package validation (in agent log)

ups		UPS subagent messages
useragent	User support application (server side)
userdb		User database (server side)

watchdog	Server watchdog
weather	Weather subagent (Open-Meteo, MET Norway, Bright Sky)
webapi.objtools	WebAPI object tool execution and streaming
webapi.tls	WebAPI TLS reverse proxy (reproxy)
websocket	WebSocket client (default tag, callers may override)
websvc		Web services
wincert		Windows certificate store metrics
winevt		Windows event collection (server side)
winnt		WINNT platform subagent messages
wol		Wake-on-lan functions


zone.*		Zone related
zone.proxy	Zone proxy related
