Reference: Sensor configuration options – Capsule8

The following table describes the environment variables and configuration file values used by the Capsule8 sensor. Configuration file values are written as object.subobject. For example, the following yaml entry

service:
   metadata:
     labels:
       - "region=US-EAST-1"

is written as service.metadata.labels.

Variable Name	Configuration File Value	Type	Meaning	Default	Example
	cloud_meta	string	The possible values are `aws`, `gcp`, or `auto` to instruct the sensor to auto-detect the metadata service.	“off”	N/A
CAPSULE8_CONFIG	N/A	string	Alternate location and name of the capsule8-sensor.yaml file	/etc/capsule8/capsule8-sensor.yaml	CAPSULE8_CONFIG=/var/run/myconfig.yaml
CAPSULE8_LABELS	service.metadata.labels	string	a string of key value pairs separated by = metadata about the sensor host	“”	CAPSULE8_LABELS=“mtahost=true”
CAPSULE8_DEBUG	debug	boolean	whether or not to enable debugging / profiling features and logging	false	CAPSULE8_DEBUG=true
CAPSULE8_LOG_OUTPUT	log_output	string	path which to write service logs	“”	CAPSULE8_LOG_OUTPUT=/var/log/capsule8-sensor.log
CAPSULE8_LOG_LEVEL	log_level	string	message level at which to log	info	CAPSULE8_LOG_LEVEL=debug
CAPSULE8_INITIAL_RECONNECT_ATTEMPTS	initial_reconnect_attempts	integer	the number of times the sensor attempts to connect to the console before giving up at startup	3	CAPSULE8_INITIAL_RECONNECT_ATTEMPTS=8
CAPSULE8_MONITOR_PORT	monitor_port	integer	TCP port to serve health checks, version, varz and profiling endpoints	9010	CAPSULE8_MONITOR_PORT=9999
CAPSULE8_LISTEN_ADDR	listen_addr	string	socket address for the sensor telemetry service to listen on (can be a unix socket)	unix://var/run/capsule8/sensor.sock	CAPSULE8_LISTEN_ADDR=localhost:8443
CAPSULE8_EVENTS_PER_MESSAGE	bundler.events_per_message	integer	number of telemetry events to send to the console at a time, useful for microbatching / controlling network impact of the sensor	1	CAPSULE8_EVENTS_PER_MESSAGE=250
CAPSULE8_EVENTS_FLUSH_TIMEOUT	bundler.flush_timeout	duration string	maxmium amount of time Telemetry Events can stay buffered in the sensor before being sent to the Capsule8 Console	“100ms”	CAPSULE8_EVENTS_FLUSH_TIMEOUT=“250ms”
CAPSULE8_FLIGHT_RECORDER_ENABLED	investigations.flight_recorder.enabled	boolean	activate the embedded flight recorder (and enable investigations)	false	CAPSULE8_FLIGHT_RECORDER_ENABLED=true
N/A	investigations.flight_recorder.tables	list	the tables and configurations to use when flushing data	“”	N/A
N/A	investigations.sinks	list	the sinks to use when flushing data	“”	N/A
N/A	investigations.reporting_interval	string	the time duration that describes the flusher’s intervals between reports	“”	N/A
CAPSULE8_FLUSHER_SERVER_MAX_PAYLOAD_SIZE	investigations.max_payload_size	int	maximum number of bytes for a single flushed payload	4194304	CAPSULE8_FLUSHER_SERVER_MAX_PAYLOAD_SIZE=true
CAPSULE8_FLUSHER_SERVER_TIMEOUT	investigations.timeout	string	the time duration string that sets the flusher’s timeour	5s	CAPSULE8_FLUSHER_SERVER_TIMEOUT=“2h45m”
CAPSULE8_EVENT_REORDER_WINDOW	event_reorder_window	time.Duration	set the delay over which events will be reordered	75ms	CAPSULE8_EVENT_REORDER_WINDOW=0ms
CAPSULE8_INOTIFY_REQUEST_QUEUE_SIZE	inotify_request_queue_size	int	specify the queue size to use for attaching inotify watchers and checking for lost writes	1024	CAPSULE8_INOTIFY_REQUEST_QUEUE_SIZE=0
CAPSULE8_RUNTIME_DIR	runtime_dir	string	location for runtime use	/var/run/capsule8	CAPSULE8_RUNTIME_DIR=/var/run/capsule8
CAPSULE8_SUPPORT_DIR	support_dir	string	location for support files	/var/lib/capsule8	CAPSULE8_SUPPORT_DIR=/var/lib/capsule8
CAPSULE8_SENSOR_DOCKER_DATA_ROOT	docker_data_root	string	Docker’s configured data root path	/var/lib/docker	CAPSULE8_SENSOR_DOCKER_DATA_ROOT=/var/lib/docker
N/A	use_perf_sensor_bin	boolean	Use the C-based sensor for collecting telemetry over the Go-based one	false

Related: Sample config file

Related: Sample config file

Related articles