The file connector type is used to retrieve data from any text file. One string in a file is considered to be one event. Strings delimiter: \n
. This type of connector is available for Linux agents and for Windows agents.
To read Windows files, you need to create a connector of the file type and manually install the agent on Windows. In one Windows Agent, you can configure multiple connections of different types, but there must be only one of the 'file' type. The Windows agent must not read its files in the folder where the agent is installed.
We do not recommend running the agent under an administrator account; read permissions for folders/files must be configured for the user account of the agent. We do not recommend installing the agent on important systems; it is preferable to send the logs and read them on dedicated hosts with the agent.
Settings for a connector of the file type are described in the following tables.
Basic settings tab
Setting |
Description |
---|---|
Name |
Unique name of the resource. Maximum length of the name: 128 Unicode characters. Required setting. |
Tenant |
The name of the tenant that owns the resource. Required setting. |
Type |
Connector type. You need to select file. Required setting. |
Path to the file. |
The full path to the file that you want to interact with. For example,
|
Auditd |
Using the auditd mechanism to group auditd event lines received from the connector into an auditd event. If you enable this toggle switch, you cannot select a value in the because Delimiter drop-down list because /n is automatically selected for the auditd mechanism. If you enable the toggle switch in the connector settings of the agent, you need to select \n in the Delimiter drop-down list in the connector settings of the collector to which the agent sends events. The maximum size of a grouped auditd event is approximately 4,174,304 characters. |
For Windows |
Receiving Windows event log events from the Windows agent. To enable the toggle switch, you need to enable the Auditd toggle switch. The toggle switch is turned off by default. |
Description |
Description of the resource. Maximum length of the description: 4000 Unicode characters. |
Advanced settings tab
Setting |
Description |
---|---|
Debug |
Resource logging. The toggle switch is turned off by default. |
Buffer size |
Connector buffer size in bytes for accumulating events in the RAM of the server before sending sending them for further processing or storage. The value must be a positive integer. Default connector buffer size: 1,048,576 bytes (1 MB). Maximum connector buffer size: 67,108,864 bytes (64 MB). |
Number of handlers |
Number of handlers that the service can run simultaneously to process response rules in parallel. To determine the number of handlers, you can use the following formula: (<number of CPUs> / 2) + 2. |
Poll interval, ms |
The interval, in milliseconds, at which the connector will reread files in the directory. The interval is applied only if there the file has no changes. For example, if the file is constantly being modified, and in the Poll interval, ms, you entered We recommend using a Poll interval, ms less than the value in the Event buffer TTL field because doing otherwise may adversely affect the operation of the Auditd function. |
Character encoding |
Character encoding. The default value is |
Event buffer TTL |
Buffer lifetime for auditd event lines, in milliseconds. Auditd event lines enter the KUMA collector and accumulate in the buffer. This allows multiple auditd event lines to be grouped into a single auditd event. The buffer lifetime countdown begins when the first auditd event line is received or when the previous buffer lifetime expires. Possible values: 700 to 30,000. The default value is This field is available if you have enabled the Auditd toggle switch on the Basic settings tab. The auditd event lines accumulated in the buffer are kept in the RAM of the server. We recommend caution when increasing the buffer size because memory usage by the KUMA collector may become excessive. You can see how much server RAM the KUMA collector is using in KUMA metrics. If you want a buffer lifetime to exceed 30,000 milliseconds, we recommend using a different auditd event transport. For example, you can use an agent or pre-accumulate auditd events in a file, and then process this file with the KUMA collector. |
Transport header |
Regular expression for auditd events, which is used to identify auditd event lines. You can use the default value or edit it. The regular expression must contain the You can revert to the default regular expression for auditd events by clicking Set default value. |