Moogsoft Docs

Observe Polling LAM Reference

This is a reference for the Observe Polling LAM . The Observe Polling LAM configuration file is located at: $MOOGSOFT_HOME/config/observe_client_lam.conf

It contains the following sections and properties.

Monitor

name : Name of the LAM.

Type : String
Required : Yes
Default : "Observe Client Monitor" . Do not change.

class : Class of the LAM.

Type : String
Required : Yes
Default : "CRestClientMonitor" . Do not change.

request_interval : Length of time to wait between requests, in seconds. You can override this value by setting request_interval in individual targets.

Type : Integer
Required : Yes
Default : 60

targets : Top-level container for which you can define one or more target Observe sources. You can specify the configuration for each target.

Type : JSON Object
Required : Yes
Default : N/A

authentication_type : Defines the HTTP authentication type the Observe Polling LAM uses.

Type : String
Required : Yes
One of : jwt_token : JSON Web Token authentication.
basic : Basic authentication. Uses the configuration in the basic authorization header of requests.
none : No authentication.
Default : "jwt_token"

url : The Event Endpoint from Observe.

Type : String
Required
: Yes
Default
: N/A

jwt_token : The JSON Bearer Token from Observe.

Type : String
Required
: If authentication_type = jwt_token
Default
: N/A

timeout : Length of time to wait before halting a connection or read attempt, in seconds.

Type : Integer
Required : Yes
Default : 120

disable_certificate_validation : Specifies whether to disable SSL certificate validation. If set to true t he data transmission between Moogsoft AIOps and your Observe server is not protected by the encryption protocol.

Type : Boolean
Required : Yes
Default : False

path_to_ssl_files : Path to the directory that contains the SSL certificates. You can use a relative path based upon the $MOOGSOFT_HOME directory. For example, the default config indicates $MOOGSOFT_HOME/config .

Type : String
Required : If disable_certificate_certification = false
Default : "config"

server_cert_filename : Name of the SSL root CA file. Must reside in the location contained in path_to_ssl_files

Type : String
Required : If disable_certificate_certification = false
Default : N/A

client_key_filename : Name of the SSL client key file.

Type : String
Required : If disable_certificate_certification = false
Default : N/A

client_cert_filename : Name of the SSL client certificate.

Type : String
Required : If disable_certificate_certification = false
Default : N/A

requests_overlap : If events meet the overlap_identity_fields matching criteria during this interval (specified in seconds), they are not treated as duplicates. Used to ensure that Moogsoft AIOps does not miss valid events. Setting this field to 0 disables all duplicate matching.

Type : Integer
Required : No
Default : 10

num_threads : Number of worker threads to use.

Type : Integer
Required : No
Default : The number of available CPUs, up to a maximum of 8

overlap_identity_fields : A list of payload tokens the LAM uses to identify duplicate events when requests_overlap is greater than 0, or when Observe returns all open events and not just updated events. The LAM treats events with the same overlap_identity_fields as duplicate events. The LAM identifies duplicates for each payload event in the previous request only. Identification is based on the token names of the returned payload, not the mapped names. For example, including $signature refers to this value in the payload, not event.value("signature") .

Type : String
Required
: No
Default : N/A
Example :

overlap_identity_fields: [ "signature", "severity" ]

page_size : Number of paginated results Observe sends.

Type : Integer
Required
: No
Default : 100

Agent

name : Identifies events the Observe Polling LAM sends to the Message Bus.

Type : String
Required : Yes
Default : "Observe Client"

capture_log: Location of the Observe Polling LAM's capture log file. The capture log contains the raw data the LAM receives. See Moogsoft AIOps Component Logs for more information.

Type : String
Required : No
Default : N/A