Official releases of the Centrify Analytics Sensor
2.1K
This repository offers the Docker images to run the Centrify Analytics Sensor. When you run an Analytics Sensor Docker container, it will automatically register a Sensor with Analytics Sensor Service based on provided environment variables. The sensor will be deleted automatically after the docker container shuts down.
For now, Centrify Analytics Sensor only supports File source. Also the "OS User" whom runs the docker command must have access to the log file. Each Sensor can upload multiple files in one directory.
Log into Centrify Analytics portal, go to Settings -> API -> New to create an API Access Token. In order to register an Sensor docker, "analytics_sensor" Scope must be selected. Make a note of the API Token, you will need the token when you run the Docker container.
Following example will upload and parse all the logs in files start with "messages" under /var/log/:
docker run \
-d \
-e API_TOKEN="******" \
-e SERVER_URL="https://******.my.centrify.com" \
-e FILE_NAME_PATTERN="messages.*" \
-e SENSOR_NAME="docker-sensor" \
-e SOURCE_CATEGORY="docker-sensor" \
-e AUTO_START="true" \
-e DESCRIPTION="Syslog file sensor, running as Docker container" \
-e FILTER_NAMES="Audit Trail Syslog" \
-v /var/log/:/sensor/log_source/ \
centrify/analytics-agent:latest
| Environment Variable | Description | Required | Default Value |
|---|---|---|---|
API_TOKEN | The Analytics API Token, use to register the server. The token must have analytics_sensor privilege | Yes | |
SERVER_URL | Centrify Analytics service address, should match your Tenant ID | No | https://${TENANT_ID}-my.analytics.centrify.com |
FILE_NAME_PATTERN | Use java regular-expression to specify the files need to be upload. | Yes | |
SENSOR_NAME | Name of this sensor | Yes | |
SOURCE_CATEGORY | Source Category of the event send by this sensor. You can filter by this "source_category" in Explorer in Analytics portal to quickly filter all events send by this senso.r | No | docker-sensor |
AUTO_START | If set to true, the sensor will automatically start to send event. Otherwise, you should manually start sending event in Source's Operation. | No | true |
DESCRIPTION | Description of this source | No | |
FILTER_NAMES | Enter a comma-separated list of one or more filters to apply to the files | Yes |
Specify a local path which contains the log files. Use -v to mount it to "/sensor/log_source/" inside the container.
Analytic Portal provides you a convenient tool to compose the docker run command: Login to Centrify Analytics Portal -> Settings -> Sensor -> Add sensor -> Generate Docker command to run Sensor Docker image. Then follow the instructions to fill all the parameters then click Generate to generate the command.
Content type
Image
Digest
Size
220.8 MB
Last updated
almost 8 years ago
docker pull centrify/analytics-agent