uberAgent

uberAgent.conf

July 22, 2024

Contributed by:

uberAgent.conf is uberAgent’s main configuration file. It includes additional configuration files for uberAgent ESA which are maintained in the uberAgent-ESA-rules GitHub repository where they’re updated frequently.

The content of the uberAgent.conf file that ships with uberAgent is listed below. An alternative configuration file that is optimized for data volume is available, too.

#
# This is the default configuration file for uberAgent
# On Windows, place it in the same directory as uberAgent.exe
#
# On macOS, this file must be located in /Library/Application Support/uberAgent. Make sure to save changes to this file as uberAgent.conf.
# uberAgent-default.conf serves as a fallback, and is overwritten with the most current default configuration during updates.

#
# Documentation: /en-us/uberagent/7-0-0/installation/configuration-through-config-file.html
#

############################################
#
# Products
#
# a)  UXM (User Experience Monitoring)
#
#     This is the default product. It is always enabled.
#
# b)  ESA (Endpoint Security Analytics)
#
#     ESA is an optional add-on product that requires UXM to work. Please note that ESA must be licensed independently of UXM.
#
# Configurable settings in this section:
#
#   Setting name: EnableESA
#   Description: Enables the Endpoint Security Analytics product
#   Valid values: true | false
#   Default: false
#   Required: no
#
############################################

[ProductComponents]
EnableESA = true

############################################
#
# General configuration
#
# Configurable settings in this section:
#
#   Setting name: DebugMode
#   Description: When in debug mode, uberAgent's log file is more verbose, providing more detail on what is going on.
#   Valid values: true | false
#   Default: false
#   Required: no
#
#   Setting name: LogFileCount
#   Description: Number of log files to keep (current + historical). When exceeded, the oldest log file is deleted.
#   Valid values: any positive integer
#   Default: 5
#   Required: no
#
#   Setting name: EncryptUserNames
#   Description: If enabled, user and domain names are encrypted in the agent before being sent off to Splunk. This can be useful for compliance with privacy regulations.
#   Valid values: true | false
#   Default: false
#   Required: no
#
#   Setting name: LicenseFilePath
#   Description: Path to a directory where uberAgent searches for license files. For more details see /en-us/uberagent/7-0-0/uxm-features-configuration/central-license-file-management.html
#   Valid values: Any valid path (local or UNC)
#   Default: empty
#   Required: no
#
#   Setting name: RegisterIEAddOn
#   Description: Register or deregister uberAgent's Internet Explorer add-on through the service.
#   Valid values: 0 = do nothing, 1 = register the add-on, 2 = deregister the add-on
#   Default: 0
#   Required: no
#
#   Setting name: BrowserDataCollection
#   Description: Enable or disable data collection of uberAgent's browser extensions. Currently this setting is used only in our Firefox extension.
#   Valid values: 0 = do nothing, 1 = enable data collection, 2 = disable data collection
#   Default: 1
#   Required: no
#
#   Setting name: RegistryMonitoring
#   Description: When disabled (false), no registry monitoring is performed. Registry monitoring requires ESA being enabled.
#   Valid values: true | false
#   Default: true
#   Required: no
#
#   Setting name: RemoteThreadMonitoring
#   Description: When disabled (false), no remote thread monitoring is performed. Remote Thread monitoring requires ESA being enabled and Activity Monitoring being configured.
#   Valid values: true | false
#   Default: true
#   Required: no
#
#   Setting name: ConfigFlags
#   Description: Define additional implementation defined flags.
#   Valid values: A comma- or semicolon-separated list of any of the following strings
#     - NoGatewayCheck                       - disable the check for a configured Default Gateway for non-PPP network interfaces
#     - IEIgnoreFrames                       - disable determination of performance data for frames in Internet Explorer
#     - RegMonSvcDebugOutput                 - enable Registry Monitoring debug output to ProcMon
#     - TLSRevocationChecksDisabled          - disable certificate revocation checks, e.g. during testing with self-signed certificates on the backend (Windows only)
#     - TLSRevocationChecksBestEffort        - ignore certificate revocation checks in case of missing or offline distribution points (Windows only). If both revocation check options are configured, the option above takes precedence. For more details on these two options see https://curl.se/libcurl/c/CURLOPT_SSL_OPTIONS.html
#     - EnableESFileSystemMonitoring         - collects data for the fields ProcIOWriteCount and ProcIOPSWrite of the sourcetype ProcessDetail on macOS. May increase uberAgent's CPU utilization.
#     - SessionHelperQueryDelayMs:NUMBER     - delay between queries to in-session helper processes. Replace NUMBER with any integer >= 0 to specify the delay in ms.
#     - TraceLogFilterExpression:REGEX       - include messages matching the regular expression REGEX in the log, regardless of their log level. This includes trace-level messages not included with DebugMode = true. REGEX must match the complete source string.
#     - EnableSystemLog                      - send log entries to the system's native log system in addition to the log file. Only available on macOS.
#     - CitrixSDKMaxRecordCount:NUMBER       - defines the -MaxRecordCount parameter for each Citrix (Remote) PowerShell SDK call. Replace NUMBER with any integer >= 0 (default is 1000).
#     - CitrixODataAPIMaximumAttempts:NUMBER - defines the maximum amount of repeating API queries if a query is responding with a not successful status code (default is 10).
#     - POQSendWaitDelayMs:NUMBER            - defines the delay between two send attempts if the persistent output queue is processed (default is 500ms). Valid values are between 100 and 10000.
#     - NetworkCommunicationTimeoutMs:NUMBER - defines a timeout for network communication (default is 10000ms). Valid values are between 100 and 1000000.
#     - LockEnterMaxWaitMs:NUMBER            - defines a duration in milliseconds if an internal locking mechanism took to long to enter/succeed. A trace log message will be written. Valid values are >= 100 (default is 1000).
#     - LockHeldMaxWaitMs:NUMBER             - defines a duration in milliseconds if an internal locking mechanism was held for more than the defined number. A trace log message will be written. Valid values are >= 100 (default is 1000).
#   Default: empty
#   Required: no
#
############################################

[Miscellaneous]
DebugMode = true

############################################
#
# Data receivers
#
# uberAgent sends data to the receivers configured here.
# If multiple [Receiver] sections are specified, data will be sent to EACH receiver. This can be overridden per Timer by specifying a comma-separated list of receivers.
# To load-balance and fail over between servers specify multiple comma-separated values for "Servers" in a SINGLE receiver section
#
# The documentation for the Persistent Output Queue options can be found here: /en-us/uberagent/7-0-0/advanced-topics/persistent-output-queue.html
#
# Configurable settings in this section:
#
#   Setting name: Name
#   Description: Arbitrary name for the data receiver. If no persistent output queue is configured the name is used only internally. Otherwise the name is used as an appendix for the persistent output queue file name.
#   Valid values: any string
#   Default: empty
#   Required: Required only if persistent output queue is activated for this receiver. In this case the name must be unique for all receivers.
#
#   Setting name: Type
#   Description: Receiver type.
#   Valid values: Splunk | Elasticsearch | OMSLogAnalytics | Kafka
#   Default: Splunk
#   Required: yes
#
#   Setting name: Protocol
#   Description: How to send data to the backend.
#      TCP uses a direct TCP connection
#      HTTP sends to a REST endpoint via HTTP or HTTPS
#      For type Splunk use TCP or HTTP, for all other types use HTTP.
#   Valid values: TCP | HTTP
#   Default: TCP
#   Required: no
#
#   Setting name: Servers
#   Description: List of target servers/URLs.
#   Valid values:
#      TCP: comma-separated list of server:port, e.g.: localhost:19500, splunksrv:12345
#      HTTP: comma-separated list of URLs starting with http or https.
#         Splunk example: http://server1:8088, https://server2:8088
#         OMS Log Analytics example: https://CUSTOMERID.ods.opinsights.azure.com
#   Default: empty
#   Required: yes
#
#   Setting name: RESTToken
#   Description: Authentication token required by the Splunk HTTP Event Collector and by OMS Log Analytics.
#     For Type OMSLogAnalytics use the primary or the secondary key for the workspace.
#     For Type Elasticsearch credentials in format
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

uberAgent.conf

July 22, 2024

Contributed by:

July 22, 2024

Contributed by:

uberAgent.conf

In this article