After installation, the liagent.ini file contains preconfigured default settings for the Log Insight Linux Agent.
vRealize Log Insight Linux Agent liagent.ini Default Configuration
If you use non-ASCII names and values, save the configuration as UTF-8.
If you are using central configuration, the final configuration is this file joined with settings from the server to form the liagent-effective.ini file.
You may find it more efficient to configure the settings from the server's agents page.
[server] ; Hostname or IP address of your Log Insight server / cluster load balancer. Default: ;hostname=LOGINSIGHT ;Enables or deactivates centralized configuration from the vRealize Log Insight server. ;When enabled, agent configuration changes made to the liagent.ini file on the server ;are joined with the settings in this file. to this agent. Accepted values are yes or no and 0 or 1. ;The default is yes. ; ;central_config=yes ; ; ; Protocol can be cfapi (Log Insight REST API), syslog. Default: ;proto=cfapi ; Log Insight server port to connect to. Default ports for protocols (all TCP): ; syslog: 514; syslog with ssl: 6514; cfapi: 9000; cfapi with ssl: 9543. Default: ;port=9543 ; SSL usage. Default: ;ssl=yes ; Example of configuration with trusted CA: ;ssl=yes ;ssl_ca_path=/etc/pki/tls/certs/ca.pem ; Time in minutes to force reconnection to the server. ; This option mitigates imbalances caused by long-lived TCP connections. Default: ;reconnect=30 ; FIPS mode. ; Possible values are 1 or 0. If omitted the default value is 1. ; ssl_fips_mode=1 [logging] ; Logging verbosity: 0 (no debug messages), 1 (essentials), 2 (verbose with more impact on performance). ; This option should always be 0 under normal operating conditions. Default: ;debug_level=0 [storage] ; Max local storage usage limit (data + logs) in MBs. Valid range: 100-2000 MB. ;max_disk_buffer=2000 ; Uncomment the appropriate section to collect system logs ; The recommended way is to enable the Linux content pack from LI server ;[filelog|syslog] ;directory=/var/log ;include=messages;messages.?;syslog;syslog.?
IP address or host name of the vRealize Log Insight virtual appliance.
The default is loginsight.
Activate or deactivate centralized configuration for this agent. When centralized configuration is deactivated, the agent ignores configuration provided by the vRealize Log Insight server. Accepted values are
Protocol that the agent uses to send log events to the vRealize Log Insight server. The possible values are
The default is cfapi.
|port||9543, 9000, 6514, and 514||Communication port that the agent uses to send events to the vRealize Log Insight server. The default values are 9543 for cfapi with SSL enabled, 9000 for cfapi with SSL deactivated, 6514 for syslog with SSL enabled and 514 for syslog with SSL deactivated.|
||Enables or deactivates SSL. The default value is yes.
|max_disk_buffer||200|| The maximum disk space in MB that the Log Insight Linux Agent uses to buffer events and its own logs.
When the specified max_disk_buffer is reached, the agent begins to drop new incoming events.
|debug_level||0||Defines the log details level. See Define Log Details Level in the Log Insight Agents.|
|ssl_fips_mode||1||Enables or deactivates FIPS mode for the Log Insight Linux Agent through the liagent.ini file. Accepted values are 1 and 0.|