Skip to main content

Configure the Socket LAM

The Socket LAM:

  • Monitors data being written to a network socket.

  • Parses this data according to the LAM’s configuration file.

  • Constructs events that are passed to the Message Bus.

You can configure how the Socket LAM processes data. Moogsoft Onprem expects the data to be written to the socket as a series of tokens that are delimited in a predictable, repeatable and regular way.

The Socket LAM takes its input from a UNIX TCP socket. The details of how the network connection is established is defined in the Socket LAM configuration, socket_lam.conf, in the monitor section, where you can configure three parameters to control how the connection is established.]

Socket LAM conforms to the Java platform standard on Time Conversion.

Configure the LAM

Edit the configuration file to control the behavior of the Socket LAM. You can find the file at $MOOGSOFT_HOME/config/socket_lam.conf.

See the LAM and Integration Reference for a full description of all properties. Some properties in the file are commented out by default; remove the '#' character to enable them.LAM and Integration Reference

  1. Configure the connection properties:

    • mode: Connection mode. Choose from CLIENT or SERVER. In CLIENT mode, the Socket LAM attempts to connect to your defined address and port. In SERVER mode, the Socket LAM opens the address and port number as a listening socket that can accept inbound connections. It will sit and wait until the source of the data makes a successful attempt to do a TCP connect to the address and port, spawning a standard TCP socket on which to except input

    • address: Address on the Moogsoft Onprem server that listens for messages.

    • port: Port on the Moogsoft Onprem server that listens for messages.

    • protocol_type: Connection protocol to use. Only applies if mode is set to SERVER.

  2. Configure the LAM behavior:

    • event_ack_mode: When Moogfarmd acknowledges events from the TBD LAM during the event processing pipeline.

    • num_threads: Number of worker threads to use for processing events.

    • stream_mode: Determines the behavior of suffix data.

  3. Optionally configure the LAM identification and capture logging details:

    • name: Maps to $Laminstancename, so that the agent field indicates events Moogsoft Onprem ingests from this LAM.

    • capture_log: Name and location of the LAM's capture log file, which it writes to for debugging purposes.

  4. Optionally configure severity conversions. See Severity Reference for further information and "Conversion Rules" in Tokenize Source Event Data for details on conversions in general.Data Parsing

  5. Optionally configure the process logging details:

    • configuration_file: Name and location of the LAM's process log configuration file. See Configure Logging for more information.Configure Logging

  6. Configure data parsing. See Tokenize Source Event Data for further information.Data Parsing

Configure for High Availability

Configure the Socket LAM for high availability if required. See High Availability Overview for details.

Configure LAMbot processing

The Socket LAMbot processes and filters events before sending them to the Message Bus. You can customize or bypass this processing if required. You can also load JavaScript files into the LAMbot and execute them.

See LAMbot Configuration for more information. An example Socket LAM filter configuration is shown below.

filter:
{
    presend: "SocketLam.js",
    modules: [ "CommonUtils.js" ]
}

Start and Stop the LAM

Restart the Socket LAM to activate any changes you make to the configuration file or LAMbot.

The LAM service name is Socketlamd.

See Control Moogsoft Onprem Processes for the commands to start, stop and restart the LAM.

You can use a GET request to check the status of the Socket LAM. See "Check the LAM Status" in Configure the REST LAM for further information and examples.

In this section: