engine.conf.spec file

engine.conf.spec file

This is the spec file for engine.conf.

# Copyright (C) 2011 Splunk Inc. All Rights Reserved.
#
# This file contains possible attribute/value pairs for configuring data collection 
# behavior in engine.conf. This file is used in the Splunk App for VMware Forwarder Appliance.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles


[default]
* This stanza defines default settings to apply to every other stanza.
* This is optional.

#******************************************************************************
# The possible attributes/value pairs for the [default] stanza, and their
# default values, are:
#******************************************************************************

faName = <Unique name of this FA instance>
* Optional.  If left unspecified, the default value is the FA's IP address.
* This is the name given to an FA; it should be set to a unique value for each FA.  More
  specifically, it is the value of the Òfa=<faName>Ó field that is set in all events generated by
  the Engine.  Since this is really just a string label, it can be any value (a unique name,
  short / long DNS hostname, IP address, etc.)  

appFunctionMetrics = (ON|OFF)
* The AppFunctionMetrics value determines whether or not certain key VI SDK functions
  are profiled for execution time.  This is useful for debugging but it puts indexes
  additional data (under the sourcetype vmware:_internal) 

customInvSourceWhitelist = <regex>
* Optional. The perl compatible regular expression that matches to the
  inventory sources you wish to include. Sources are separated by "|".
  Set InventoryLevel=Custom to enable this filter.
* If left unspecified, the default value is ".", and the regular expression
  matches any source.
* If both CustomInvSourceWhitelist and CustomInvSourceBlacklist are specified,
  a source is indexed only when it matches CustomInvSourceWhitelist but 
  does not match CustomInvSourceBlacklist.

customInvSourceBlacklist = <regex>
* Optional. The perl compatible regular expression that matches to the
  inventory sources you wish to exclude. Sources are separated by "|".
  Set InventoryLevel=Custom to enable this filter.
* If left unspecified, no source will be matched.
* If both CustomInvSourceWhitelist and CustomInvSourceBlacklist are specified,
  a source is indexed only when it matches CustomInvSourceWhitelist but 
  does not match CustomInvSourceBlacklist.

hierarchyExpiration = <seconds>
* Optional.  If left unspecified, the default value is 900 (15 minutes).
* This is the amount of time that HierarchyDiscovery will run before starting to refresh
  data on the current snapshot of hierarchy objects.
* Recommended setting is at least 15 minutes for monitoring 10 ESX/i hosts
* This setting may need to be much higher in a large-scale environment (e.g. 1 minute per host)

hierarchyTimeSlot = <seconds>
* Optional.  If left unspecified, the default value is 3 seconds.
* This is the amount of time that HierarchyDiscovery will pull hierarchy data before stopping and
  letting another discovery module run.
* Recommend that this value be set smaller than the Interval value.

inventoryExpiration = <seconds>
* Optional.  If left unspecified, the default value is 900 (15 minutes).
* This is the amount of time that InventoryDiscovery will run before starting to refresh
  data on existing inventory objects.
* Recommended setting is at least 15 minutes for a VC that is managing 10 ESX/i hosts
* This setting may need to be much higher in a large-scale environment.  For example, 1 minute per
  host is recommended, assuming hosts have 10 VMs each on average.  The value may need to be set
  higher if hosts are running a much higher number of VMs on average.


[<server spec>]
* This stanza enables properties for a given <server spec>. 
* Each stanza in engine.conf must have a unique name.
* A engine.conf file must contain at least one stanza for each Vmware host or VirtualCenter
  server. The recommendation is to have two stanzas for each Vmware server, one for actions
  that require faster updates (PerformanceDiscovery, InventoryDiscovery and HierarchyDiscovery),
  another one for actions with slower update actions (the rest of the actions.) It is OK to
  use more stanzas to further customize the action intervals.
* The name of the stanza should not contain understores ("_").

#******************************************************************************
# The possible attributes/value pairs for each engine.conf stanza, and their
# default values, are:
#******************************************************************************

url = <URL>
* The URL to connect to; it is the same value as variable VI_URL in VI SDK.
  The value typically has format of https://<host name or ip>/sdk/webService.

username = <username>
* The username to login to the url; it is the same value as variable VI_USERNAME in
  VI SDK.

password = <password>
* The password to login to the url; it is the same value as variable VI_PASSWORD in
  VI SDK.

host = <name>
* Optional. The host property for a Splunk entry; the default value is the host 
  name or IP address of the url.

action = <module-list>
* Optional. The list of modules (delimited by comma) to run this stanza.
* If this value is not present, TimeDiscovery will be preformed.
* Available discovery actions are:
  - InventoryDiscovery
  - HierarchyDiscovery
  - PerfDiscovery
  - EventDiscovery
  - TaskDiscovery
  - LogDiscovery

disabledAction = <module-list>
* Optional. The list of modules (delimited by comma) to disable; this value
  has higher priority than Action.
	
interval = <seconds>
* Optional. The smallest interval for each module to run.
* If this value is not present, a default value of 3 will be used.

invBlacklist = <regex>
* Optional.  The managed entity components to filter out of inventory collection.
* The valid high level inventory components to filter out are:
  - ClusterComputeResource
  - ComputeResource
  - Datacenter
  - Folder
  - HostSystem
  - ResourcePool
  - VirtualMachine
* If not included, the above entities are collected

inventoryLevel = (All|Required|Custom)
* Optional. Control the amount of inventory data to be indexed.
* Default value is All, and all inventory sources are indexed.
* If InventoryLevel=Required, only a small set of predefined
  sources are indexed.
* If InventoryLevel=Custom, CustomInvSourceWhitelist and/or CustomInvSourceBlacklist
  are used to filter out unwanted sources.

perfManagedEntityWhitelist = <regex>
* Optional. The perl compatible regular expression that matches to the managed entities
  types you wish to include. Entitiy types are separated by "|".
* The allowed entity names are:
  - ClusterComputeResource
  - ComputeResource
  - HostSystem,
  - ResourcePool
  - VirtualApp
  - VirtualMachine
* It is suggested to use PerfManagedEntityWhitelist with value ClusterComputeResource
  and ComputeResource with vCenters, and omit this field for Hosts.
* If this value is not present, all above 6 managed entities are included.

perfTypeWhitelist = <regex>
* Optional. The perl compatible regular expression that matches to the performance
  type you wish to include. Perf types are separated by "|".
* The allowed values include:
  - cpu
  - disk
  - net
  - mem
  - power
  - ds    (datastore)
  - cl    (clusterServices)
  - ma    (managementAgent)
  - sa    (storageAdapter)
  - spth  (storagePath)
  - rcpu  (rescpu)
  - vdsk  (virtualDisk)
  - vcdbg (vcDebugInfo)
  - vcres (vcResources)
  - sys   (system)
* If this value is not present, all performance types are included.

perfLevel = <level>
* Optional. Define the maximum level of the performance counters (1,2,3, or 4).
* This is enabled only if 1 or more vCenter defined in this .conf file.  This is because the level
  information is defined in vCenter.
* If specifies 2, it includes level 1 and 2 performance counters.  The default is 4.
* For Performance counter level, please reference:
http://www.vmware.com/support/developer/vc-sdk/visdk41pubs/ApiReference/vim.HistoricalInterval.html#level
* This settings does not impact your actual data you collect in vCenter.

eventHistory = <hours>
* Optional. The event history specifies the number of hours you wish to go back
  in time to collect events.
* Increasing the EventHistory value increases the amount of time the EventDiscovery
  module takes on its first pass, which increases the time it takes for splunk 
  to start processing data from VMware.
* If this value is not present, event collection starts at the time when the
  EventDiscovery module begins running.

eventWhitelist = <regex>
* Optional. The perl compatible regular expression that matches file names to be
  indexed. Event types are separated by "|".
* The value matches event types.
* If this value is not present, all log events will be indexed.

logWhitelist = <regex>
* Optional. The perl compatible regular expression that matches file names to be 
  indexed. File names are separated by "|".
* The value matches to the end of a log line.
* If this value is not present, all logs will be indexed.

taskHistory = <hours>
* Optional. The task history specifies the number of hours you wish to go back
  in time to collect tasks.
* Increasing the TaskHistory value increases the amount of time the TaskDiscovery
  module takes on its first pass, which increases the time it takes for splunk
  to start processing data from VMware.
* If this value is not present, event collection starts at the time when the
  TaskDiscovery module begins running.