This illustration shows the three components in the flow of collection from a source (secured target) which is on the left, to the agent which is in the middle, and to the Audit Vault Server which is on the right. The source creates audit trails. The agent comprises of collector threads. The agent thread contains the agent framework and the collection framework. The collector thread contains the collection framework and the collector. It has two collector threads within the agent. The collection starts with the Audit Vault Server and sending a message to the Agent Thread to start collection. Then Agent Thread starts the collector thread. The collector thread collects the audit trails from the source and sends the audit records to the Audit Vault Server. This flow is controlled by the management commands from the Audit Vault Server.