config.zeek¶

ClusterAgent¶

Configuration settings for a cluster agent.

Namespace: ClusterAgent
Imports: policy/frameworks/cluster/controller/types.zeek

Summary¶

Redefinable Options¶

`ClusterAgent::cluster_directory`: `string` `&redef`	The working directory for data cluster nodes created by this agent.
`ClusterAgent::controller`: `Broker::NetworkInfo` `&redef`	The network coordinates of the controller.
`ClusterAgent::default_address`: `string` `&redef`	The fallback listen address if `ClusterAgent::listen_address` remains empty.
`ClusterAgent::default_port`: `port` `&redef`	The fallback listen port if `ClusterAgent::listen_port` remains empty.
`ClusterAgent::directory`: `string` `&redef`	An optional custom output directory for the agent’s stdout and stderr logs.
`ClusterAgent::listen_address`: `string` `&redef`	The network address the agent listens on.
`ClusterAgent::listen_port`: `string` `&redef`	The network port the agent listens on.
`ClusterAgent::name`: `string` `&redef`	The name this agent uses to represent the cluster instance it manages.
`ClusterAgent::stderr_file_suffix`: `string` `&redef`	Agent stderr log configuration.
`ClusterAgent::stdout_file_suffix`: `string` `&redef`	Agent stdout log configuration.
`ClusterAgent::topic_prefix`: `string` `&redef`	The agent’s Broker topic prefix.

Functions¶

`ClusterAgent::endpoint_info`: `function`	Returns a `Broker::EndpointInfo` record for this instance.
`ClusterAgent::instance`: `function`	Returns a `ClusterController::Types::Instance` describing this instance (its agent name plus listening address/port, as applicable).

Detailed Interface¶

Redefinable Options¶

ClusterAgent::cluster_directory ¶

Type: string
Attributes: &redef
Default: ""

The working directory for data cluster nodes created by this agent. If you make this a relative path, note that the path is relative to the agent’s working directory, since it creates data cluster nodes.

ClusterAgent::controller ¶

Type

Broker::NetworkInfo

Attributes

&redef

Default

{
   address="0.0.0.0"
   bound_port=0/unknown
}

The network coordinates of the controller. When defined, the agent peers with (and connects to) the controller; otherwise the controller will peer (and connect to) the agent, listening as defined by ClusterAgent::listen_address and ClusterAgent::listen_port.

ClusterAgent::default_address ¶

Type: string
Attributes: &redef
Default: ""

The fallback listen address if ClusterAgent::listen_address remains empty. Unless redefined, this uses Broker’s own default listen address.

ClusterAgent::default_port ¶

Type: port
Attributes: &redef
Default: 2151/tcp

The fallback listen port if ClusterAgent::listen_port remains empty.

ClusterAgent::directory ¶

Type: string
Attributes: &redef
Default: ""

An optional custom output directory for the agent’s stdout and stderr logs. Agent and controller currently only log locally, not via the data cluster’s logger node. (This might change in the future.) This means that if both write to the same log file, the output gets garbled.

ClusterAgent::listen_address ¶

Type: string
Attributes: &redef
Default: ""

The network address the agent listens on. This only takes effect if the agent isn’t configured to connect to the controller (see ClusterAgent::controller). By default this uses the value of the ZEEK_AGENT_ADDR environment variable, but you may also redef to a specific value. When empty, the implementation falls back to ClusterAgent::default_address.

ClusterAgent::listen_port ¶

Type: string
Attributes: &redef
Default: ""

The network port the agent listens on. Counterpart to ClusterAgent::listen_address, defaulting to the ZEEK_AGENT_PORT environment variable.

ClusterAgent::name ¶

Type: string
Attributes: &redef
Default: ""

The name this agent uses to represent the cluster instance it manages. Defaults to the value of the ZEEK_AGENT_NAME environment variable. When that is unset and you don’t redef the value, the implementation defaults to “agent-<hostname>”.

ClusterAgent::stderr_file_suffix ¶

Type: string
Attributes: &redef
Default: "agent.stderr"

Agent stderr log configuration. Like ClusterAgent::stdout_file_suffix, but for the stderr stream.

ClusterAgent::stdout_file_suffix ¶

Type: string
Attributes: &redef
Default: "agent.stdout"

Agent stdout log configuration. If the string is non-empty, Zeek will produce a free-form log (i.e., not one governed by Zeek’s logging framework) in Zeek’s working directory. The final log’s name is “<name>.<suffix>”, where the name is taken from ClusterAgent::name, and the suffix is defined by the following variable. If left empty, no such log results.

Note that the agent also establishes a “proper” Zeek log via the ClusterController::Log module.

ClusterAgent::topic_prefix ¶

Type: string
Attributes: &redef
Default: "zeek/cluster-control/agent"

The agent’s Broker topic prefix. For its own communication, the agent suffixes this with “/<name>”, based on ClusterAgent::name.

Functions¶

ClusterAgent::endpoint_info ¶

Type: function () : Broker::EndpointInfo

Returns a Broker::EndpointInfo record for this instance. Similar to ClusterAgent::instance, but with slightly different data format.

ClusterAgent::instance ¶

Type: function () : ClusterController::Types::Instance

Returns a ClusterController::Types::Instance describing this instance (its agent name plus listening address/port, as applicable).