Name

Unique name of the resource. Maximum length of the name: 128 Unicode characters.

Required setting.

Tenant

The name of the tenant that owns the resource.

Required setting.

Type

Connector type. You need to select udp.

Required setting.

URL

URL that you want to connect to. You can enter a URL in one of the following formats:

• <host name>:<port number>
• <IPv4 address>:<port number>
• <IPv6 address>:<port number>
• :<port number>

Required setting.

Auditd

Using the auditd mechanism to group auditd event lines received from the connector into an auditd event.

If you enable this toggle switch, you cannot select a value in the because Delimiter drop-down list because /n is automatically selected for the auditd mechanism.

If you enable the toggle switch in the connector settings of the agent, you need to select \n in the Delimiter drop-down list in the connector settings of the collector to which the agent sends events.

The maximum size of a grouped auditd event is approximately 4,174,304 characters.

Delimiter

The character that marks the boundary between events. Available values:

• \n
• \t
• \0

If you do not select a value, \n is selected by default.

Description

Description of the resource. Maximum length of the description: 4000 Unicode characters.

Buffer size

Connector buffer size in bytes for accumulating events in the RAM of the server before sending sending them for further processing or storage. The value must be a positive integer. Default connector buffer size: 1,048,576 bytes (1 MB). Maximum connector buffer size: 67,108,864 bytes (64 MB).

Character encoding

Character encoding. The default value is UTF-8.

Event buffer TTL

Buffer lifetime for auditd event lines, in milliseconds. Auditd event lines enter the KUMA collector and accumulate in the buffer. This allows multiple auditd event lines to be grouped into a single auditd event.

The buffer lifetime countdown begins when the first auditd event line is received or when the previous buffer lifetime expires. Possible values: from 50 to 30,000. The default value is 2000.

This field is available if you have enabled the Auditd toggle switch on the Basic settings tab.

The auditd event lines accumulated in the buffer are kept in the RAM of the server. We recommend caution when increasing the buffer size because memory usage by the KUMA collector may become excessive. You can see how much server RAM the KUMA collector is using in KUMA metrics.

If you want a buffer lifetime to exceed 30,000 milliseconds, we recommend using a different auditd event transport. For example, you can use an agent or pre-accumulate auditd events in a file, and then process this file with the KUMA collector.

Transport header

Regular expression for auditd events, which is used to identify auditd event lines. You can use the default value or edit it.

The regular expression must contain the record_type_name, record_type_value, and event_sequence_number groups. If a multi-line auditd event contains a prefix, the prefix is retained for the first line of the auditd event and discarded for the following lines.

You can revert to the default regular expression for auditd events by clicking Set default value.

Compression

Using Snappy compression. Available values:

• Disabled. The default value.
• Use Snappy.

Debug

Resource logging. The toggle switch is turned off by default.