Overview
You can use this document to learn about the configuration parameters available in a configuration file, specifically for Agent Settings.
Review Parameters for Agent Settings
YAML | Description |
anomaly_capture_size |
This parameter represents the number of log lines (buffer size) to capture during an anomaly capture. The default value is 125. This parameter is optional. |
anomaly_capture_bytesize |
This parameter represents the maximum buffer size (in bytes) to capture during an anomaly capture. The default value is 0b (disabled). This parameter is optional. |
anomaly_capture_duration |
This parameter represents the maximum time span that the logs of an anomaly capture can belong to, such as logs from the last 10 minutes. The default value is 0s (disabled). This parameter is optional. |
anomaly_coefficient |
This parameter represents the anomaly coefficient used to multiply the final score to a range of 0 - 100. The default value is 10. This parameter is optional. |
anomaly_confidence_period | |
anomaly_tolerance |
When it is non-zero, anomaly scores handle edge cases better when standard deviation is too small. For some rules types, this parameter can be set at the rule level. The default value is 0.01. This parameter is optional. |
archive_destination |
This parameter allows an existing integration to stream logs to an S3. endpoint. For example, if enabled, the AWS S3 integration will stream logs to an AWS S3 endpoint.
This parameter is optional. |
attributes |
This parameter defines a user-defined, key-value pair that is used to label and distinguish different running agents. You can set keywords for app, environment, and region.
This parameter is optional. |
capture_flush_mode |
This parameter sets the behavior for flushing captured contextual log buffers. This parameter supports the following modes:
The default value is local_per_source. This parameter is optional. |
log |
This parameter contains additional subfields to configure an agent's log settings. Specifically, you can configure the following parameters: Level
agent_settings: tag: prod log: level: debug Secure Logging
This parameter is optional.
|
multiline_max_bytesize |
This parameter configures the buffer byte size for multiline accumulation. The default value is 10 KB. This parameter is optional. |
multiline_max_size |
This parameter defines the buffer length size for multiline accumulation. If there is an overflow of lines, then those extra lines are dumped as a single line. The default value is 250. This parameter is optional. |
only_report_nonzeros |
This parameter configures if non-zero stats should be reported or not. For some rules types, this parameter can be set at the rule level. The default value is false. This parameter is optional. |
skip_empty_intervals |
This parameter configures if empty intervals should be skipped so that anomaly scores are calculated based on non-zero intervals. For some rules types, this parameter can be set at the rule level. The default value is false. This parameter is optional. |
soft_cpu_limit |
This parameter allows you to use more CPU than what is specified in the allocation. This parameter is only honored by the clustering processor at the moment. 0.5 means 50% of a core. This parameter complements the cpu_friendly parameter for Processors. To enable, in the clustering rule, set cpu_friendly=true. The default value is 0.0. This parameter is optional. |
tag |
This parameter is a user-defined tag used to describe the environment, such as prod_us_west_2_cluster. While the default value is Edge, we recommend that you set a value. This parameter is optional. |
max_file_per_glob_path |
Enter the maximum number of files to tail, per glob path. The default value is 100. This parameter is optional. |
forget_file_after |
Enter a length of time to drop files that have not been modified. The default value is 1h. This parameter is optional. |
total_seek_capacity |
Enter the maximum size that tailers can seek concurrently. The default value is 5MB. This parameter is optional. |
max_seek_size |
Enter the maximum size that a tailer can seek, per second. This parameter is optional. |
source_discovery_interval |
Enter how often the source discovery is invoked. The default value is 5s. This parameter is optional. |
file_tailer_buffer_size |
Enter the maximum number of logs that a file tailer can store in its memory until the logs are ingested by the agent’s internal router. If the router is busy and cannot ingest the logs and the tailer’s buffer is reached, then the seeking will be blocked. The default value is 1000. This parameter is optional. |
router_per_source_buffer_size |
Enter the maximum number of logs that an agent’s internal router can store in its memory, per source. The default value is 1000. This parameter is optional. |
archive_flush_interval |
Enter a time frame to flush and send logs to a configured archiving destination. The default value is 5m. This parameter is optional. |
archive_max_byte_limit |
Enter the maximum number of bytes that can be buffered (in memory) before a flush is triggered to an archive destination. The default value is 26MB. This parameter is optional. |
Review Parameters for Attributes
Review the following parameters that you can configure in the Edge Delta App:
YAML | Description |
app |
Enter a descriptive label that will be used to enrich data generated by the agent. This parameter is optional. |
environment |
Enter a descriptive label that will be used to enrich data generated by the agent. This parameter is optional. |
region |
Enter a descriptive label that will be used to enrich data generated by the agent. This parameter is optional. |
Review the following YAML example of Attributes:
attributes: environment: prod app: smp region: us-west
Review YAML Example of Agent Settings
agent_settings:
tag: prod_payments
log:
level: info
persisting_cursor_settings:
path: /var/lib/edgedelta/cursor_provider
file_name: cursor_provider.json
flush_interval: 5s
soft_cpu_limit: 0.5
anomaly_tolerance: 0.1
anomaly_confidence_period: 1m
skip_empty_intervals: false
only_report_nonzeros: false
anomaly_capture_size: 1000
anomaly_capture_bytesize: "10 KB"
anomaly_capture_duration: 1m
anomaly_coefficient: 10.0
grace_period: 30s
Create and Manage Agent Settings
To create and manage agent settings, you must populate a YAML file.
To access the YAML file for a new configuration:
- In the Edge Delta App, on the left-side navigation, click Data Pipeline, and then click Agent Settings.
- Click Create Configuration.
- Click YAML.
- Enter the desired parameters, and then click Save.
To access the YAML file for an existing configuration:
- In the Edge Delta App, on the left-side navigation, click Data Pipeline, and then click Agent Settings.
- Locate the desired configuration, then under Actions, click the vertical ellipses, and then click Edit.
- Review the YAML file, make your changes, and then click Save.