You can override the default values of the agent configuration file with common parameter values that apply for each agent configuration section for Windows or Linux agents.

Common Options

Options specified in the [common|global] section of the liagent.ini configuration file are propagated to all sections, options specified in the [common|filelog] section are propagated to all and only filelog sections, and [common|winlog] options are propagated to all and only winlog sections.

You can define the following parameters in common sections: tags, include, exclude, event_marker, charset, exclude_fields, and parser as shown in the following example. The example is for a Windows agent: 

[common|global]

tags = {"log_source_vm":"win-2008r2-64"}
exclude_fields = test_tag;some_other_tag
parser = auto

[common|filelog]
tags = {"collector_type":"filelog"}
exclude = *.trc

[filelog|channel_1]
directory = C:\app\log
include = *.log

...
This example specifies the following behavior:
  • All logs from filelog sections have both log_source_vm and collector_type tags with their corresponding values.
  • test_tag and some_other_tag tags are excluded from all logs sent.
  • auto parser is applied to all collected logs.
  • By default, all filelog collectors exclude *.trc files from monitoring.
Options in [common|global] are also applied to all winlog sections.

Merge and Override Criteria

If options are defined in more than one section, their values are merged or overridden and the section with a smaller scope has a higher priority when merging/overriding. That is, a value from [common|global] is merged with or overridden by a value from [common|filelog]] which in turn is combined with or overridden by a value from [filelog|sample_section].

Merge and override behavior conform to the following rules:

  • Options whose values represent a list of values (tags, include, exclude and exclude_fields ) are merged with values of that option from a section with a higher priority. And in case of tags, values of tags from sections with a higher priority override the value of that same tag from a section with a lower priority, as described previously.
  • The value of options that can have single value (event_marker, charset and parser) are overridden by values of that option from sections with higher priority.

    This means that the value of charset=UTF-8 from [filelog|sample_section] overrides the global value of charset= UTF-16LE from [common|global].

So, for example, if you have tags={"app":"global-test"} in [common|filelog] and tags={"app":"local-test","section":"flg_test_section"} in [filelog|flg_test_section], the value of the "app" tag from the [filelog|flg_test_section] section overrides the value from [common|filelog]. All logs collected through this filelog section will have an additional "app" tag with "local-test" value and "section" tag with "flg_test_section" value. For winlog sections, the chain of priority is the same, with any [winlog|...] section having the highest priority and [common|global] having the lowest priority.

When invalid values are specified in common sections, generally they are skipped and not merged with values from prior and corresponding filelog/winlog sections. In the case of invalid values in tags or exclude_fields options, the agent extracts as much valid data as possible and skips the rest of the file once invalid data is encountered. All anomalies are reported in the agent log file. Consult the log file if unexpected behavior is encountered and fix all errors reported by the agent.

If the agent detects an invalid value for an option in a filelog or winlog section, then it does not merge option values from that section with option values from common sections and does not enable that section. All errors are reported in an agent log file. Consult the log file if unexpected behavior is encountered and fix all reported errors by agent.