mirror of
https://github.com/pathtofile/Sealighter
synced 2026-06-08 16:41:39 +00:00
pathtofile
68 lines
2.1 KiB
Markdown
68 lines
2.1 KiB
Markdown
# Buffering
|
|
Buffering enables the reporting of many similar events in a time period as one with a count.
|
|
|
|
Events are buffered together by collapsing events with a matching set of properties.
|
|
|
|
For example, in a Process Trace, you could buffer all process starts of `cmd.exe` together,
|
|
only reporting one event per minute. That event with contain a `buffered_count` field with the
|
|
number of `cmd.exe`s seen that minute.
|
|
|
|
|
|
There are two things to configure to enable buffering:
|
|
- [Buffering Timeout](#Buffering-Timeout)
|
|
- [Per-Provider Buffers](#Per-Provider-Buffers)
|
|
|
|
## Buffering Timeout
|
|
By setting the `buffering_timout_seconds` option in the `session_properties` config
|
|
header sets the time between 'flushes' of events, and therefore the time period to
|
|
report similar events as one:
|
|
```json
|
|
"session_properties": {
|
|
"buffering_timout_seconds": 10
|
|
},
|
|
// ...
|
|
```
|
|
If not set, the default is 30 seconds.
|
|
|
|
|
|
## Per-Provider Buffers
|
|
To enable buffering for a provider, add the `buffer` key:
|
|
```json
|
|
"user_traces": [
|
|
{
|
|
"trace_name": "ProcTrace01",
|
|
"provider_name": "Microsoft-Windows-Kernel-Process",
|
|
"keywords_any": 16,
|
|
"buffers": [
|
|
{
|
|
"event_id": 1,
|
|
"max_before_buffering": 1,
|
|
"fields": [
|
|
"ImageName"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
Buffers are configured per event ID, they have the following fields:
|
|
- [event_id](#event_id)
|
|
- [max_before_buffering](#max_before_buffering)
|
|
- [properties_to_match](#properties_to_match)
|
|
|
|
|
|
### event_id
|
|
The Event ID to buffer
|
|
|
|
|
|
### max_before_buffering
|
|
The number of events to report as-is before starting to buffer.
|
|
This enables you to specify "No more than X matching events per Y seconds".
|
|
If set to `0` then all matching events will be buffered together.
|
|
|
|
|
|
### properties_to_match
|
|
This is an array of the names of the event properties to buffer events on.
|
|
Events that have the same values in all of these fields are considered 'the same'
|
|
and will be buffered together.
|