Host GS: Aggregation Configuration Nodes

Document created by RSA Information Design and Development on Mar 21, 2017
Version 1Show Document
  • View in full screen mode
  

This topic lists and describes the available configuration settings that are common to services that perform aggregation, such as RSA Security Analytics Concentrators and Archivers.

Aggregation Configuration Settings

This table lists and describes the settings that control aggregation on an aggregating service.

                                                                                                                 
Configuration Path/concentrator/config or /archiver/config
aggregate.autostartAutomatically restarts aggregation after a service restart, if enabled. Change takes effect immediately.
aggregate.buffer.sizeDisplays the size of the buffer (default unit is KB) used per round of aggregation. Larger buffers may improve aggregation performance but could impact query performance. Change takes effect after aggregation restart.
aggregate.crcIf enabled, all aggregation streams will be CRC validated. Change takes effect immediately.
aggregate.hoursDisplays the maximum number of hours behind a service will be allowed to start aggregation. Change takes effect immediately.
aggregate.intervalLists the minimum number of milliseconds before another round of aggregation is requested. Change takes effect immediately.
aggregate.meta.page.factorLists the allocated number meta pages per session used for aggregation. Change takes effect on service restart.
aggregate.meta.perpageLists the allocated number of meta stored on one page of data. Change takes effect on service restart.
aggregate.precacheDetermines if the concentrator will precache the next round of aggregation for upstream services. Can improve aggregation performance but could impact query performance. Change takes effect immediately.
aggregate.sessions.maxLists the number of sessions to aggregate on each round. Change takes effect after aggregation restart.
aggregate.sessions.perpageLists the number of sessions stored on one page of data. Change takes effect on service restart.
aggregate.time.windowDisplays the maximum +/- time window, in seconds, that all services must be inside before another round of aggregation is requested. Zero turns off time window. Change takes effect immediately.
consume.modeDetermines if the concentrator can only aggregate locally or over a network, based on licensing restrictions. Change takes effect on service restart.
export.enabledAllows export of session data, if enabled. Change takes effect on service restart.
export.expire.minutesLists the number of minutes before export cache files are expired and flushed. Change takes effect immediately.
export.formatDetermines the file format used during data export. Change takes effect on service restart.
export.local.pathDisplays the local location to cache exported data. Optional assigned max size (=#unit), units are: t for TB; g for GB, m for MB. Change takes effect on service restart.
export.meta.fieldsDetermines which meta fields are exported. Comma list of fields. Star means all fields. Star plus field list means all fields BUT listed fields. Just field list says just include those fields. Change takes effect immediately.
export.remote.pathDisplays the remote protocol (nfs://) and location to export data. Change takes effect on service restart.
export.rollupDetermines the rollup interval for export files. Change takes effect on service restart.
export.session.maxDisplays the maximum sessions per exported file. For export file types that cache this determines cached memory sizes. Zero is no limit. Change takes effect immediately.
export.size.maxDisplays the maximum bytes per exported file. For export file types that cache this determines cached memory sizes. Zero is no limit. Change takes effect immediately.
export.usage.maxDisplays the maximum percentage of cache space used before stopping aggregation. Zero is no limit. Change takes effect immediately.
heartbeat.errorLists the number of seconds to wait after a service error before attempting a service reconnect. Change takes effect immediately.
heartbeat.intervalLists the number of milliseconds between heartbeat service checks. Change takes effect immediately.
heartbeat.next.attemptLists the number of seconds to wait before attempting a service reconnect. Change takes effect immediately.
heartbeat.no.responseLists the number of seconds to wait before taking unresponsive service offline. Change takes effect immediately.
You are here
Table of Contents > References > Service Configuration Settings > Aggregation Configuration Nodes

Attachments

    Outcomes