openwec.conf.sample.toml

#######################
##  Server settings  ##
#######################

[server]

# [Optional]
# Set subscriptions refresh interval
# Subscriptions are stored in the database. When you edit them using the cli,
# you only modify the database.
# The server retrieves its subscriptions from the database and cache
# them in memory. The in-memory subscriptions are refreshed at a fixed
# interval: `db_sync_interval`.
# Default value is 5 seconds.
# db_sync_interval = 5

# [Optional]
# Set heartbeat cache flush interval
# Heartbeat messages are cached in memory before being stored in database
# to improve performances.
# A flush operation saves all cached heartbeats in database at a fixed
# interval: `flush_heartbeats_interval`
# Default value is 5 seconds.
# flush_heartbeats_interval = 5

# [Optional]
# To "store" a heartbeat, request handlers send a message to a task responsible
# for managing heartbeats using a queue.
# The database store operation may take some time. During this operation, new heartbeats message
# are not popped from the queue, leading to the queue being full. When the queue is full,
# request handlers have to wait before sending a response to clients.
# You can customize the size of the queue, depending of the expected output of heartbeats
# messages to store and the duration of the database store operation.
# Default size of the queue is 2048.
# heartbeats_queue_size = 2048

# [Optional]
# Set node name
# This may be used by outputs. Unset by default.
# node_name = unset

# [Optional]
# Keytab file path that contains secrets for Kerberos SPNs used by collectors.
# Required if Kerberos authentication is used by at least one collector.
# It must contain entries for service principals used by collectors.
# It can contain other entries that aren't used by openwec.
# keytab = "/etc/krb5.keytab"

# [Optional]
# Set the duration to remain idle before sending TCP keepalive probes.
# Defaults to 7200
# tcp_keepalive_time = 7200

# [Optional]
# Set the duration between two successive TCP keepalive retransmissions,
# if acknowledgement to the previous keepalive transmission is not received.
# Defaults to None (i.e. system value)
# tcp_keepalive_intvl = None

# [Optional]
# Set the number of retransmissions to be carried out before declaring
# that remote end is not available.
# Defaults to None (i.e. system value)
# tcp_keepalive_probes = None

##########################
##   Logging settings   ##
##########################

[logging]

# [Optional]
# Set server logging verbosity
# This parameter is overwritten by --verbosity argument.
# Default value is warn 
# Possible values are: error, warn, info, debug, trace
# verbosity = "warn"

# [Optional]
# Server logs destination, can be :
# - stdin
# - stderr
# - <path>: logs will be stored in the given file
# Default value is stderr
# server_logs = stderr

# [Optional]
# Server log formatting pattern
# Pattern syntax is explained here: https://docs.rs/log4rs/latest/log4rs/encode/pattern 
# Default value is None, meaning "{d} {l} {t} - {m}{n}"
# server_logs_pattern = None

# [Optional]
# Access logs destination, can be :
# - stdin
# - stderr
# - <path>: logs will be stored in the given file
# - None: disable access logs
# Default value is None
# access_logs = None

# [Optional]
# Access log formatting pattern
# Pattern syntax is explained here: https://docs.rs/log4rs/latest/log4rs/encode/pattern 
# Contextual information can be accessed using {X(<value>)}. Available values are:
# - http_status
# - http_method
# - http_uri
# - response_time (in ms)
# - ip
# - port
# - principal
# - conn_status: 'X' (connection aborted before the response completed)
#                '+' (connection may be kept alive after the response is sent)
# Default value is None, meaning "{X(ip)}:{X(port)} - {X(principal)} [{d}] \"{X(http_uri)}\" {X(http_status)} {X(response_time)}{n}"
# access_logs_pattern = None

##########################
##  Databases settings  ##
##########################

# Two database backends are currently supported: SQLite and Postgres.
# Note that Postgres implementation is made to work well with CockroachDB.

[database]
# [Required]
# Database type: SQLite | Postgres
# type = "SQLite"

## SQLite configuration

# SQLite DB path
# The SQLite DB will be created and initialised if it does not already exist.
# path = "/var/db/openwec/openwec.sqlite"

## End of SQLite

## Postgres configuration

# [Required]
# Postgres database Hostname
# host = "localhost"

# [Required]
# Postgres database port
# port = 5432 

# [Required]
# Postgres database name. It must already exist and user <postgres.user> should
# have all permissions on it.
# dbname = "openwec"

# [Required]
# Postgres database user. It must already exist and have all permissions
# on <postgres.dbname>.
# user = "openwec"

# [Required]
# Postgres database user password
# password = ""

# [Optional]
# Postgres SSL mode. Possibles values are:
# - Disable: Do not use TLS
# - Prefer: Attempt to connect with TLS but allow sessions without
# - Require: Require the use of TLS
# ssl_mode = "Prefer"

# [Optional]
# Custom SSL CA certificate file
# When ssl_mode is Prefer or Require, you may want to use a specific CA
# certificate file instead of the ones trusted by your system (default).
# ca_file = unset

# [Optional]
# Max chunk size
# When performing bulk insert queries, this is the maximum number of
# entries that will be inserted in one query.
# max_chunk_size = 500

## End of Postgres configuration

###########################
##  Collectors settings  ##
###########################

# You may define multiple collect servers.
# Each collector must listen on a different (address, port) pair.
# All collectors share the same database.
# This is useful if you want to support both Kerberos and TLS authentication

# This defines one collector
[[collectors]]
# [Required]
# Local Hostname
# Clients will contact this hostname to send their events
# hostname = "openwec.mydomain.local"

# [Required]
# Server listen address
# listen_address = "127.0.0.1"

# [Optional]
# Server listenning port
# If missing in config, default value is 5985
# listen_port = 5985

# [Optional]
# Maximum content size allowed in client messages.
# If missing in config, default value is 512000 (which should be safe)
# max_content_length = 512000

# [Optional]
# Enable PROXY protocol
# This feature allows openwec to be used behind a layer 4 load balancer
# whilst the PROXY protocol is enabled to preserve the client IP address and port.
# If enabled, openwec EXPECTS a PROXY protocol header (v1 or v2) to be present
# and will close the connection otherwise.
# enable_proxy_protocol = false

# [Optional]
# openwec will pretend to listen on this port instead of the "real" one
# configured in `listen_port`.
# This can be useful if openwec is behind a load balancer.
# If unset, the default value is `listen_port`.
# advertized_port =

# Authentication settings for this collector
[collectors.authentication]
# [Required]
# Authentication method: Kerberos, Tls
# type = "Kerberos"

## Kerberos configuration

# [server.keytab] is required when using Kerberos authentication

# [Required]
# Service Principal Name of the openwec account
# Should be something like "HTTP/openwec.mydomain.local@MYDOMAIN.LOCAL"
# service_principal_name = ""

## End of Kerberos configuration

## TLS configuration

# [Required]
# CA certificate used to sign client certificates
# ca_certificate = "/etc/ca-cert.pem"

# [Required]
# Server certificate
# server_certificate = "/etc/server-cert.pem"

# [Required]
# Server private key, corresponding to the certificate
# server_private_key = "/etc/server-key.pem"

## End of TLS configuration

##########################
##     Cli settings     ##
##########################

[cli]

# [Optional]
# If set, subscriptions can only be updated using `openwec subscriptions load` command.
# This is useful if you want to rely on files to configure your subscriptions
# and want to enforce that subscriptions can not be updated directly.
# read_only_subscriptions = false

##########################
##   Outputs settings   ##
##########################

[outputs]

# [Optional]
# The interval (in seconds) at which the outputs garbage collector is run.
# It is responsible for closing unused resources, such as file descriptors that have
# not been touched in a while (see 'outputs.files.files_descriptor_close_timeout')
# garbage_collect_interval = 600

# [outputs.files]
# [Optional]
# Files descriptor that have not beed written to for more than <files_descriptor_close_timeout>
# will be closed each time the garbage collector runs.
# files_descriptor_close_timeout = 600

# [outputs.kafka]
# [Optional]
# When using multiple Kafka outputs, there is a chance that they will connect to a single Kafka cluster.
# In this case, it is more resource efficient to use a single Kafka client instead of
# one per output.
# To do this, instead of configuring Kafka options in each output, configure them
# once here. The options are sent directly to librdkafka
# (see https://docs.confluent.io/platform/current/clients/librdkafka/html/md_CONFIGURATION.html).
#
# Notes:
# - You can still use different topics for each output.
# - If you configure Kafka options in an output, a dedicated Kafka client will be
#     used for that output regardless of this setting.
# options = {}