jcoffey-dev
4df6931869
Agents now send an independent "still alive" record on a configurable schedule (seconds/minutes/hours, [heartbeat] in agent.toml), separate from real log traffic and tagged with a sentry.heartbeat attribute. No new wire protocol -- it's an ordinary record through the same PushBatch RPC/mTLS identity every log line already uses. Unavailability alerting reuses the existing absence-condition alert rule type unchanged; no new alerting code was needed. See /docs/agent-heartbeat-monitoring.md for the design and how to build the alert rule. While verifying the alert rule live, found that the query language's lexer never treated '-' as part of an identifier, so any unquoted hyphenated filter value -- including the reference doc's own canonical example, `host!=host-03` -- failed to parse at all. Fixed in api/internal/querylang/lexer/lexer.go with regression tests; a leading '-' still lexes as its own token so earliest=-1h/sort -count are unaffected.
61 lines
2.1 KiB
TOML
61 lines
2.1 KiB
TOML
# Example sentry-agent config. Copy to the platform's conventional path
|
|
# (/etc/sentry-agent/agent.toml on Linux, C:\ProgramData\SentryAgent\agent.toml
|
|
# on Windows), or pass --config /path/to/this/file.
|
|
#
|
|
# Every field has a built-in default (see src/config.rs), so this file only
|
|
# needs to contain what you're overriding. An agent with NO config file at
|
|
# all still runs: on Linux it defaults to journald, service = "default",
|
|
# and expects mTLS material at /etc/sentry-agent/{ca,client,client-key}.pem
|
|
# (Windows equivalents under C:\ProgramData\SentryAgent\).
|
|
|
|
[agent]
|
|
# host = "explicit-hostname-override" # defaults to /etc/hostname (Linux) or %COMPUTERNAME% (Windows)
|
|
service = "my-service"
|
|
|
|
[source]
|
|
kind = "journald"
|
|
# unit = "nginx.service" # omit to tail the whole journal
|
|
|
|
# To tail a file instead (works on both Linux and Windows):
|
|
# [source]
|
|
# kind = "file"
|
|
# path = "/var/log/nginx/access.log"
|
|
# from_beginning = false
|
|
|
|
# Windows Event Log (requires the agent to be built with the
|
|
# `windows-eventlog` feature — see /agent/README.md):
|
|
# [source]
|
|
# kind = "eventlog"
|
|
# channels = ["Application", "System", "Security"] # this is the default if omitted
|
|
|
|
# ETW (requires the `etw` feature, and usually elevated privileges — read
|
|
# /agent/README.md's privilege section before enabling this):
|
|
# [source]
|
|
# kind = "etw"
|
|
# providers = ["{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}"] # GUIDs, not friendly names
|
|
|
|
[batch]
|
|
max_size = 500
|
|
flush_interval_ms = 2000
|
|
|
|
[heartbeat]
|
|
# How often this agent proves it's still alive to the platform, sent as
|
|
# its own record independent of whatever real log traffic is flowing --
|
|
# pair with an "absence" alert rule on the sentry.heartbeat attribute to
|
|
# get paged when a host goes quiet. Accepts a plain number + unit: s
|
|
# (seconds), m (minutes), or h (hours) -- same vocabulary as
|
|
# earliest=/latest= in the query language. See
|
|
# /docs/agent-heartbeat-monitoring.md.
|
|
enabled = true
|
|
interval = "60s"
|
|
# interval = "5m"
|
|
# interval = "1h"
|
|
|
|
[ingest]
|
|
endpoint = "https://ingest.internal:4317"
|
|
|
|
[tls]
|
|
ca_cert = "/etc/sentry-agent/ca.pem"
|
|
client_cert = "/etc/sentry-agent/client.pem"
|
|
client_key = "/etc/sentry-agent/client-key.pem"
|