Skip to content
  • There are no suggestions because the search field is empty.

Decoder Configuration Parameters

Decoder Configuration ParametersDecoder Configuration Parameters

The following list describes the configuration parameters that are identical on both Network Decoder and Log Decoder services.

  • Configuration Path: aggregate.buffer.size
  • /config: Displays the size of the buffer (default unit is KB) used per round of aggregation. Larger buffers may improve aggregation performance but could impact capture performance. Change takes effect after capture restart.

  • Configuration Path: aggregate.precache
  • /config: Determines if the decoder will pre-cache the next round of aggregation for upstream services. Can improve aggregation performance but could impact capture performance. Change takes effect immediately.

  • Configuration Path: assembler.pool.ratio
  • /config: Displays the percentage of pool pages that assembler manages and uses for the assembly process. Change takes effect on service restart.

  • Configuration Path: assembler.session.flush
  • /config: Flushes sessions either when they are complete, or when they are parsed. Change takes effect on service restart.

  • Configuration Path: assembler.session.pool
  • /config: Lists the number of entries in the session pool. Change takes effect on service restart.

  • Configuration Path: assembler.size.max
  • /config: Lists the maximum size that a session will obtain. A setting of 0 removes the session size limit. Change takes effect immediately.

  • Configuration Path: assembler.size.min
  • /config: Lists the minimum size that a session must be before persisting. Change takes effect immediately.

  • Configuration Path: assembler.timeout.packet
  • /config: Lists the number of seconds before packets are timed out. Change takes effect immediately.

  • Configuration Path: assembler.timeout.session
  • /config: Lists the number of seconds before sessions are timed out. Change takes effect immediately.

  • Configuration Path: assembler.voting.weights
  • /config: Displays the weights used to determine which session stream is marked client and server. Change takes effect immediately.

  • Configuration Path: capture.autostart
  • /config: Determines if capture begins automatically when the service starts. Change takes effect on service restart.

  • Configuration Path: capture.buffer.size
  • /config: Displays capture memory buffer allocation size (default unit is MB). Change takes effect on service restart.

  • Configuration Path: capture.device.params
  • /config:

    Displays capture service specific parameters. Change takes effect on service restart.

    The parameters understood by this field are specific to the currently selected capture device. If any of the parameters are not recognized by the current capture device, they are ignored.

    On Log Decoders, there is only the Log Events capture device. It accepts some optional parameters.

    • use-envision-time: If this is set to 1, the time metadata for each event will be imported from the Log Collector stream. If this is 0 or not set, the imported event time will be stored in the event.time meta.
    • port: This parameter can be set to a numeric value to override the default syslog port listener, 514.

  • Configuration Path: capture.selected
  • /config: Displays current capture service and interface. Change takes effect immediately.

  • Configuration Path: export.expire.minutes
  • /config: Lists the number of minutes before export cache files are expired and flushed. Change takes effect immediately.

  • Configuration Path: export.packet.enabled
  • /config: Allows export of packet data, if enabled. Change takes effect on service restart.

  • Configuration Path: export.packet.local.path
  • /config: Displays the local location to cache packet exported data. Optional assigned max size (=#unit), units are: t for TB; g for GB, m for MB. Change takes effect on service restart.

  • Configuration Path: export.packet.max
  • /config: Displays the maximum packets per exported file. For export file types that cache this determines cached memory sizes. Zero is no limit. Change takes effect immediately.

  • Configuration Path: export.packet.remote.path
  • /config: Lists the remote protocol (nfs://) and location to export data. Change takes effect on service restart.

  • Configuration Path: export.packet.size.max
  • /config: Displays the packet maximum bytes per exported file. For export file types that cache this determines cached memory sizes. Zero is no limit. Change takes effect immediately.

  • Configuration Path: export.rollup
  • /config: Determines the rollup interval for export files. Change takes effect on service restart.

  • Configuration Path: export.session.enabled
  • /config: Allows export of session data, if enabled. Change takes effect on service restart.

  • Configuration Path: export.session.format
  • /config: Determines the file format used during session export. Change takes effect on service restart.

  • Configuration Path: export.session.local.path
  • /config: Displays the local location to cache session exported data. Optional assigned max size (=#unit), units are: t for TB; g for GB, m for MB. Change takes effect on service restart.

  • Configuration Path: export.session.max
  • /config: Displays the maximum sessions per exported file. For export file types that cache, this determines cached memory sizes. Zero is no limit. Change takes effect immediately.

  • Configuration Path: export.session.meta.fields
  • /config: Determines which meta fields are exported. Comma-separated list of fields.
    * means all fields.
    * plus field list means all fields BUT listed fields.
    Just field list means only those fields are included.
    Change takes effect immediately.

  • Configuration Path: export.session.remote.path
  • /config: Displays the remote protocol (nfs://) and location to export data. Change takes effect on service restart.

  • Configuration Path: export.session.size.max
  • /config: Lists the session maximum bytes per exported file. For export file types that cache, this determines cached memory sizes. Zero is no limit. Change takes effect immediately.

  • Configuration Path: export.usage.max
  • /config: Lists the session maximum bytes per exported file. For export file types that cache, this determines cached memory sizes. Zero is no limit. Change takes effect immediately.

  • Configuration Path: parse.threads
  • /config: Lists the number of parse threads to use for session parsing. Zero means let server decide. Change takes effect on service restart.

  • Configuration Path: pool.packet.page.size
  • /config: Displays the size of a packet page (default is KB). Change takes effect on service restart.

  • Configuration Path: pool.packet.pages
  • /config: Lists the number of packet pages decoder will allocate and use. Change takes effect on service restart.

  • Configuration Path: pool.session.page.size
  • /config: Displays the size of a session page (default is KB). Change takes effect on service restart.

  • Configuration Path: pool.session.pages
  • /config: Lists the number of session pages decoder will allocate and use. Change takes effect on service restart.

  • Column 1:
  • Column 2: