jcoffey-dev
cd8aa290ca
Extends the agent, ingest, storage, api, and web with Windows Event Log/ETW sourcing and Tantivy-backed free-text search, per the approved Phase 1 plan. - CLAUDE.md: materialized on disk (never existed as a file before) with a new Phase 1 "done looks like" section. - agent: Windows Event Log (EvtSubscribe) and ETW sources, Windows service wrapper (install/uninstall/run-service), both feature- and target_os-gated so Linux builds/tests/clippy stay unaffected. Also fixed two pre-existing Phase 0 clippy gaps (dead-code on default-features-only builds, a type-inference edge case) found while testing every feature combination properly for the first time. UNVERIFIED on real Windows -- no Windows toolchain existed anywhere in the build environment; flagged prominently in three places. - proto/ingest: new record_id field, assigned once server-side in ingest's gRPC front end so ClickHouse and Tantivy agree on the same ID for the same record. - storage: record_id column + bloom filter index, verified against a live ClickHouse. - search: new service, Tantivy index, rskafka consumer as an independent second consumer group on the same Redpanda topic ingest already reads. - api/web: new /search endpoint and page, sharing the query page's result-table shape and component. - hack/windows-fixture: sends realistic Windows-shaped data straight to ingest, so the pipeline's handling of it is verifiable without a Windows host. Verified end-to-end on the live docker-compose stack: the same record_id comes back from both /query and /search for the same log line, including for windows-fixture's synthetic Windows Event Log data. Real bugs found and fixed along the way: api/Dockerfile missing proto/ in its build context, search's logs being completely silent (RUST_LOG gap), and search/target/ missing from .gitignore/.dockerignore.
48 lines
1.6 KiB
TOML
48 lines
1.6 KiB
TOML
# Example sentry-agent config. Copy to the platform's conventional path
|
|
# (/etc/sentry-agent/agent.toml on Linux, C:\ProgramData\SentryAgent\agent.toml
|
|
# on Windows), or pass --config /path/to/this/file.
|
|
#
|
|
# Every field has a built-in default (see src/config.rs), so this file only
|
|
# needs to contain what you're overriding. An agent with NO config file at
|
|
# all still runs: on Linux it defaults to journald, service = "default",
|
|
# and expects mTLS material at /etc/sentry-agent/{ca,client,client-key}.pem
|
|
# (Windows equivalents under C:\ProgramData\SentryAgent\).
|
|
|
|
[agent]
|
|
# host = "explicit-hostname-override" # defaults to /etc/hostname (Linux) or %COMPUTERNAME% (Windows)
|
|
service = "my-service"
|
|
|
|
[source]
|
|
kind = "journald"
|
|
# unit = "nginx.service" # omit to tail the whole journal
|
|
|
|
# To tail a file instead (works on both Linux and Windows):
|
|
# [source]
|
|
# kind = "file"
|
|
# path = "/var/log/nginx/access.log"
|
|
# from_beginning = false
|
|
|
|
# Windows Event Log (requires the agent to be built with the
|
|
# `windows-eventlog` feature — see /agent/README.md):
|
|
# [source]
|
|
# kind = "eventlog"
|
|
# channels = ["Application", "System", "Security"] # this is the default if omitted
|
|
|
|
# ETW (requires the `etw` feature, and usually elevated privileges — read
|
|
# /agent/README.md's privilege section before enabling this):
|
|
# [source]
|
|
# kind = "etw"
|
|
# providers = ["{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}"] # GUIDs, not friendly names
|
|
|
|
[batch]
|
|
max_size = 500
|
|
flush_interval_ms = 2000
|
|
|
|
[ingest]
|
|
endpoint = "https://ingest.internal:4317"
|
|
|
|
[tls]
|
|
ca_cert = "/etc/sentry-agent/ca.pem"
|
|
client_cert = "/etc/sentry-agent/client.pem"
|
|
client_key = "/etc/sentry-agent/client-key.pem"
|