Skip to main content

host-linux-service datasource

The host-linux-service datasource collects information about running processes from the operating system on Linux hosts and creates entities and events.Events

Entities

Property

Description

name

The service name

init_system

The bootstrap system name (systemd)

Example

{
  "init_system": "systemd",
  "name": "auditd",
}

Events

Events are based on the values of entity properties.

“Load event”

An event based on the value of the `load` property, one of 
`bad-setting`, `error`, `loaded`, `masked`, `merged`, `not-found`, or `stub`.

```json
{
  "name": "Linux Service load_Event",
  "component": "auditd.service",
  "device": "ServerStation1",
  "source": "example_server_zdm_host",
  "eventClass": "/Status",
  "summary": "Service 'auditd.service' is loaded.",
  "body": "Service 'auditd.service' is loaded.",
  "severity": "SEVERITY_INFO",
  "status": "STATUS_OPEN"
}
```

“Primary (active) event”

An event based on the value of the `active` property, one of `activating`, 
`active`, `deactivating`, `failed`, `inactive`, or `reloading`.

```json
{
  "name": "Linux Service active_Event",
  "component": "auditd.service",
  "device": "ServerStation1",
  "source": "example_server_zdm_host",
  "eventClass": "/Status",
  "summary": "Service 'auditd.service' is active.",
  "body": "Service 'auditd.service' is active.",
  "severity": "SEVERITY_INFO",
  "status": "STATUS_OPEN"
}
```

“Secondary (sub) event”

An event based on the value of the `sub` property, one of
`abandoned`, `activating-done`, `activating`, `active`, `auto-restart`, 
`deactivating-sigkill`, `deactivating-sigterm`, `deactivating`, `dead`, 
`elapsed`, `exited`, `failed`, `final-sigkill`, `final-sigterm`, `listening`, 
`mounted`, `mounting-done`, `mounting`, `plugged`, `reload`, `remounting-sigkill`, 
`remounting-sigterm`, `remounting`, `running`, `start-chown`, `start-post`, 
`start-pre`, `start`, `stop-post`, `stop-pre-sigkill`, `stop-pre-sigterm`, 
`stop-pre`, `stop-sigkill`, `stop-sigterm`, `stop-watchdog`, `stop`, `tentative`, 
`unmounting-sigkill`, `unmounting-sigterm`, `unmounting`, or `waiting`.

```json
{
  "name": "Linux Service sub_Event",
  "component": "auditd.service",
  "device": "ServerStation1",
  "source": "example_server_zdm_host",
  "eventClass": "/Status",
  "summary": "Service 'auditd.service' is running.",
  "body": "Service 'auditd.service' is running.",
  "severity": "SEVERITY_INFO",
  "status": "STATUS_OPEN"
}
```

Configuration

If you specify the host-linux-service datasource during installation, its configuration file is placed in the following location:

/etc/zendatamon-configs/configs/host-linux-service.config.yaml

Otherwise, you must copy it from the templates directory:

cp /etc/zendatamon-configs/.templates/.configs/host-linux-service.config.yaml \
  /etc/zendatamon-configs/configs/host-linux-service.config.yaml

The Virtana Service Observability agent service monitors the /etc/zendatamon-configs/configs directory and loads any new or changed configuration files immediately.

Properties

interval (number)

The number of seconds to wait between collection attempts. This value overrides the defaultInterval value in the Virtana Service Observability agent service configuration file.

timeout (number)

The number of seconds to wait before dropping a collection attempt.

protocol (string)

Collection type; only local is supported, so this key can be omitted.

include-names (array)

A list of regular expressions identifying the names of services to collect. If empty or omitted, all services are collected.

exclude-names (array)

A list of regular expressions identifying the names of services not to collect. If empty or omitted, all services are collected.

exclude-load-statuses (array)

A list of regular expressions identifying load states not to collect. If empty or omitted, all load states are collected.

exclude-active-statuses (array)

A list of regular expressions identifying primary (active) states not to collect. If empty or omitted, all primary states are collected.

exclude-sub-statuses (array)

A list of regular expressions identifying secondary (sub) states not to collect. If empty or omitted, all secondary states are collected.

Example

apiVersion: v1
kind: datasource
name: host-linux-service
spec:
  type: host-linux-service
  datasource:
    interval: 60
    timeout: 30
    protocol: ""
    include-names: []
    exclude-names:
      - addhostname
      - anacron
      - bluetooth
      - cpuspeed
      - ondemand
      - firstboot
      - irqbalance
      - isdn
      - lvm2-monitor
      - mcstrans
      - mdmonitor
      - portreserve
      - pppd-dns
      - rpcgssd
      - rsync
      - sudo
      - sysstat
    exclude-load-statuses:
      - not-found
    exclude-active-statuses:
      - inactive
      - failed
      - deactivating
    exclude-sub-statuses:
      - exited
In this section: