> For the complete documentation index, see [llms.txt](https://wiki.datadike.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.datadike.com/pam/get-started/architecture.md).

# Architecture and components

The components a running instance is made of, what each one does, how a session travels between them, and how the network path from the solution to an asset is formed.

An instance is not a single program. It is a **core** that owns the database, the vault and every access decision, surrounded by **independent components** — one per protocol family, plus the services that store recordings, run scheduled work, and send notifications. They register themselves with the core and are listed, monitored and scaled individually.

Knowing which component does what is what turns "the PAM is down" into "RDP is down and SSH is fine".

{% hint style="info" %}
This page is about the software that runs the product. The objects you administer — assets, accounts, authorizations — are in [Core concepts](/pam/get-started/core-concepts.md). Installing and sizing the components belongs to Deploy and operate.
{% endhint %}

## The path of a session

1. **The user authenticates against the core.** The core is the REST API behind the console and behind every integration. It resolves the authorization, the account, the platform, and the network path to use.
2. **The core hands the session to the component that speaks the protocol** — the terminal connector for SSH, Telnet and SFTP, the graphical connector for RDP and VNC, the database connector for database protocols, the virtual application connector for published applications.
3. **That component connects to the asset** — directly, through a jump host, or over the reverse path — retrieving the credential from the core and injecting it into the target's login. The credential is never handed to the user's browser or client.
4. **While traffic flows, the component captures it**: commands typed, terminal output, screen frames, files transferred. It also enforces the command filters as it goes, which is why filtering works the same way for a web session and for a native client.
5. **When the session ends**, the component hands the replay file to the recording service, which writes it to the configured object storage. Graphical recordings pass through the video processing service first, to be transcoded into a replayable form.
6. **The task service** runs everything scheduled around all of this — credential rotation, account collection, connectivity checks, log cleanup — and the notification service delivers what the subscriptions ask for.

{% hint style="warning" %}
Two consequences of that shape, both worth remembering before you diagnose anything. **The core is a single point of decision**: while it is offline the console and the API are unreachable and no new session can start. **The protocol components fail independently**: with the graphical connector down, RDP and VNC sessions stop while SSH sessions keep working normally.
{% endhint %}

## The components

| Component                         | What it does                                                                                                                           | What is lost while it is offline                                 |
| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| **Core (API)**                    | The REST API. Serves the console and integrations, owns the database and the vault, and makes every access decision                    | Everything. The console is inaccessible and no session can start |
| **Task service**                  | Asynchronous and scheduled work: rotation, account collection, connectivity checks, cleanup                                            | All automation. Sessions still work, but nothing scheduled runs  |
| **Terminal connector**            | Proxy for SSH, Telnet and SFTP. Records commands, terminal output and the replay file. Serves both the web terminal and native clients | Terminal sessions, in the browser and by client                  |
| **Graphical connector**           | Proxy for RDP and VNC. Records the desktop session as video                                                                            | Graphical sessions                                               |
| **Database connector**            | Proxy for database sessions, so external database clients reach the asset through the solution with the queries audited                | Database sessions with a native client                           |
| **Virtual application connector** | Publishes individual applications from a remote server — RemoteApp and virtual apps — mediated and recorded, without a full desktop    | Published-application sessions                                   |
| **Recording service**             | Receives replay files from the protocol components and stores them in the object storage backend                                       | New recordings. Sessions still run                               |
| **Video processing service**      | Transcodes graphical recordings into the replay format used by the audit screens                                                       | Replay of new graphical sessions                                 |
| **Notification service**          | Sends email, SMS and the other configured channels                                                                                     | Alerts and approval notifications                                |
| **Facial recognition service**    | Identity verification by facial biometrics at login or during a session, when enabled                                                  | That verification method                                         |
| **Windows endpoint agent**        | Optional agent on a Windows server: asset information, local tasks, and Windows account management                                     | The features that depend on it, on that host only                |

In the console, a component is named `[Type]-ServerName` — `[Terminal]-DATADIKE-T`, `[Database]-DATADIKE`. Clicking the name opens its details.

## How components join the instance

Components register themselves with the core. **System Settings › Components › Basic** holds the switch:

| Setting               | What it controls                                                                                                          |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **Registration**      | Enabled by default. Allows any component that knows the server address to register itself after being installed           |
| **Client connection** | Whether users may launch a native SSH client. Disabled, every terminal access is forced through the recorded web terminal |
| **Database proxy**    | Enables the database connector platform-wide. Disabled, native database client sessions disappear from the whole product  |

{% hint style="warning" %}
**Turn Registration off once the components are in place.** While it is on, anything that can reach the server address can register itself as a component. Re-enable it only for as long as it takes to add a new one.
{% endhint %}

## Watching component health

**System Settings › Components › Components** lists every registered component in real time. It is the first screen to open when access misbehaves for one protocol and not another.

| Column              | What it tells you                                                                                                                                |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Name**            | `[Type]-ServerName`                                                                                                                              |
| **Online sessions** | Sessions this component is handling right now. Zero means idle; a persistently high number means it is time to add another instance of that type |
| **Stat**            | CPU and memory use of the component process. Close to 100% is saturation                                                                         |
| **Load status**     | `Normal`, `Offline` — not responding, check the service on its host — or `High load`                                                             |
| **ID**              | The component's unique identifier, as used in logs and diagnostics                                                                               |
| **Type**            | Which of the components above it is                                                                                                              |
| **Remote address**  | Address and port of the host it runs on                                                                                                          |

{% hint style="info" %}
Do not rely on someone opening this screen. An `Offline` core or connector is an availability incident, so subscribe an external monitor — Zabbix, Prometheus, Datadog — to the health endpoint and alert from there. Checking the list is a routine, not a detection mechanism.
{% endhint %}

## The network path to an asset

When the solution cannot open a connection to the asset itself, one of four objects supplies the route. Two of them are halves of the same mechanism, which is the most common source of confusion here.

| Object                                                      | Direction          | What it is                                                                                                                                                                                                   |
| ----------------------------------------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [**Proxy**](/pam/administration/connectivity/proxy.md)      | Solution → network | The **zone**: the record that groups the jump machines of one network, and that assets are attached to. A data centre, a cloud, a VPC                                                                        |
| [**Gateway**](/pam/administration/connectivity/gateways.md) | Solution → network | The **jump machine itself**, registered inside a proxy. The solution opens a session on it, with an account registered on it, and forwards traffic to the asset from inside                                  |
| [**Broker**](/pam/administration/connectivity/broker.md)    | Network → solution | A meeting point on a zero-trust overlay, reachable by both sides. Remote gateways dial *out* to it, the solution connects to it too, and they meet there. For networks that can accept no inbound connection |
| **Connector**                                               | Network → solution | An agent on the target machine itself, which enrols that one host with the broker and publishes only itself. For the isolated machine with no gateway in its network                                         |

{% hint style="warning" %}
**Proxy and gateway are not two mechanisms.** The proxy is the zone you attach assets to; the gateways are the machines registered inside it. There is no separate proxy engine configured elsewhere.

An asset uses **a proxy or a broker gateway, never both** — its registration makes you choose.
{% endhint %}

The component that talks to the broker from the solution's side is redundant by design: there is one instance per cluster node, each with its own identity, automatic enrolment, and self-recovery. Losing a node does not interrupt reverse access, and neither does losing a broker node.

## Reaching the console from outside

Users connect to the console over **HTTPS on 443** and, from there, open RDP, SSH, Telnet, VNC and database sessions. No direct connectivity between the user and the protected devices is required — which is the point, and what makes third-party access workable without a VPN.

{% hint style="danger" %}
Do not publish the console straight to the internet without a firewall and a WAF in front of it. If that protection is not in place, restrict access to a controlled VPN instead.
{% endhint %}

For the ports the solution uses to reach *assets*, see [Ports and protocols](/pam/reference/ports.md).

## Single node and cluster

The same components run in both shapes. What a cluster adds:

| Property                   | In a cluster                                                                                                |
| -------------------------- | ----------------------------------------------------------------------------------------------------------- |
| Database                   | Replicated between nodes, with automatic election of the primary                                            |
| Cache and queue            | Replicated, with failover                                                                                   |
| Recordings and attachments | On storage shared between the nodes                                                                         |
| Address                    | One virtual address in front of the nodes, so the URL does not change when a node fails                     |
| Sessions                   | Active-active: the session load is distributed across nodes, and redistributed when one becomes unavailable |
| Upgrades                   | Components are updated individually, without stopping the product                                           |

The design targets for the active-active arrangement are **RTO of one hour or less** and **RPO of fifteen minutes or less**.

## Common errors

| Symptom                                                      | Cause                                                                       | Fix                                                                    |
| ------------------------------------------------------------ | --------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| The console is unreachable and no session starts             | The core is offline                                                         | Recover the core first; nothing else can be diagnosed until it answers |
| RDP fails, SSH works                                         | The graphical connector is offline or saturated                             | Check **Load status** and **Stat** for that component                  |
| Sessions run but no replay appears in the audit trail        | The recording service, the video processing service, or the storage backend | Check those components, then the storage configuration                 |
| Nothing scheduled runs, but sessions are fine                | The task service is offline                                                 | Rotation, collection and cleanup all depend on it                      |
| A newly installed component does not appear in the list      | **Registration** is disabled                                                | Enable it, register the component, then disable it again               |
| Component shows `Normal` but sessions are slow               | High resource use rather than a fault                                       | Read **Stat**; near 100% means add another instance of that type       |
| The option to launch a database client is missing everywhere | **Database proxy** is disabled in **System Settings › Components › Basic**  | Enable it                                                              |

## Related pages

* [Core concepts](/pam/get-started/core-concepts.md) — the objects the components act on
* [Proxy](/pam/administration/connectivity/proxy.md) — the zone assets attach to
* [Gateways](/pam/administration/connectivity/gateways.md) — the jump machines inside it
* [Broker](/pam/administration/connectivity/broker.md) — the reverse path
* [Ports and protocols](/pam/reference/ports.md) — the ports used to reach assets