{"componentChunkName":"component---src-components-mark-down-block-js","path":"/docs/cli-reference/","result":{"data":{"markdownRemark":{"html":"

CLI Reference

\n
\n

In the AppScope CLI, the scope command takes a Linux command as an argument. That's called \"scoping\" the Linux command. For example, if you run scope top, we say you have \"scoped\" the top command.

\n

The AppScope CLI also has subcommands, which pair with scope to do many things. For example, if you run scope dash, AppScope displays its dashboard.

\n

This Reference explains how to use scope and its arsenal of subcommands.

\n

Subcommand Syntax

\n

To execute CLI subcommands, the basic syntax is:

\n
./scope <subcommand> [flags] [options]\n
\n

Subcommands Available

\n

To see a list of available subcommands, enter ./scope alone, or ./scope -h, or ./scope --help. This displays the basic help listing below.

\n
Cribl AppScope Command Line Interface\n\nAppScope is a general-purpose observable application telemetry system.\n\nRunning `scope` with no subcommands will execute the `scope run` command.\n\nUsage:\n  scope [command]\n\nAvailable Commands:\n  attach      Scope a currently-running process\n  completion  Generates completion code for specified shell\n  daemon      Run the scope daemon\n  dash        Display scope dashboard for a previous or active session\n  detach      Unscope a currently-running process\n  events      Outputs events for a session\n  extract     Output instrumentary library files to <dir>\n  rules       View or modify system-wide AppScope rules\n  flows       Observed flows from the session, potentially including payloads\n  help        Help about any command\n  history     List scope session history\n  inspect     Returns information about scoped process\n  k8s         Install scope in kubernetes\n  logs        Display scope logs\n  metrics     Outputs metrics for a session\n  prom        Run the Prometheus Target\n  prune       Prune deletes session history\n  ps          List processes currently being scoped\n  run         Executes a scoped command\n  service     Configure a systemd/OpenRC service to be scoped\n  snapshot    Create a snapshot for a process\n  start       Install the AppScope library\n  stop        Stop scoping all scoped processes and services\n  update      Updates the configuration of a scoped process\n  version     Display scope version\n  watch       Executes a scoped command on an interval\n\nFlags:\n  -h, --help          help for scope\n  -z, --passthrough   Scope an application with current environment & no config.\n\nUse \"scope [command] --help\" for more information about a command.\n
\n

As noted just above, to see a specific subcommand's help or its required parameters, enter:\n./scope <subcommand> -h

\n

…or:\n./scope help <subcommand>.

\n
\n

attach

\n
\n

Scopes a currently-running process identified by PID or ProcessName.

\n

The --*dest flags accept file names like /tmp/scope.log or URLs like file:///tmp/scope.log. They may also\nbe set to sockets with unix:///var/run/mysock, tcp://hostname:port, udp://hostname:port, or tls://hostname:port.

\n

Usage

\n

scope attach [flags] PID | <process_name>

\n

Examples

\n
scope attach 1000\nscope attach firefox \nscope attach top < scope.yml\nscope attach --rootdir /path/to/host firefox \nscope attach --rootdir /path/to/host/mount/proc/<hostpid>/root 1000\nscope attach --payloads 2000\n
\n

Flags

\n
  -a, --authtoken string      Set AuthToken for Cribl\n  -b, --backtrace             Enable backtrace file generation when an application crashes.\n  -d, --coredump              Enable core dump file generation when an application crashes.\n  -c, --cribldest string      Set Cribl destination for metrics & events (host:port defaults to tls://)\n  -e, --eventdest string      Set destination for events (host:port defaults to tls://)\n  -h, --help                  help for attach\n  -i, --inspect               Inspect the process after attach is complete\n  -j, --json                  Output as newline delimited JSON\n  -l, --librarypath string    Set path for dynamic libraries\n      --loglevel string       Set scope library log level (debug, warning, info, error, none)\n  -m, --metricdest string     Set destination for metrics (host:port defaults to tls://)\n      --metricformat string   Set format of metrics output (statsd|ndjson) (default \"ndjson\")\n      --metricprefix string   Set prefix for StatsD metrics, ignored if metric format isn't statsd\n  -n, --nobreaker             Set Cribl to not break streams into events.\n  -p, --payloads              Capture payloads of network transactions\n  -R, --rootdir               Path to root filesystem of target namespace\n  -u, --userconfig string     Scope an application with a user specified config file; overrides all other settings.\n  -v, --verbosity int         Set scope metric verbosity (default 4)\n
\n

completion

\n
\n

Generates completion code for specified shell.

\n

Usage

\n

scope completion [flags] [bash|zsh]

\n

Examples

\n
scope completion bash > /etc/bash_completion.d/scope # Generate and install scope autocompletion for bash\nsource <(scope completion bash)                      # Generate and load scope autocompletion for bash\n
\n

Flags

\n
  -h, --help   help for completion\n
\n

dash

\n
\n

Displays an interactive dashboard with an overview of what's happening with the selected session.

\n

Usage

\n

scope dash [flags]

\n

Examples

\n

scope dash

\n

Flags

\n
  -h, --help     help for dash\n  -i, --id int   Display info from specific from session ID (default -1)\n
\n

detach

\n
\n

Unscopes a currently-running process identified by PID or process name.

\n

Usage

\n

scope detach [flags] PID | <process_name>

\n

Examples

\n
scope detach 1000\nscope detach firefox\nscope detach --all\nscope detach 1000 --rootdir /path/to/host/mount\nscope detach --rootdir /path/to/host/mount\nscope detach --all --rootdir /path/to/host/mount/proc/<hostpid>/root\n
\n

Flags

\n
  -a, --all                   Detach from all processes\n  -h, --help                  Help for detach\n  -R, --rootdir               Path to root filesystem of target namespace\n  -w, --wait                  Wait for detach to complete\n
\n

events

\n
\n

Outputs events for a session. You can obtain detailed information about each event by inputting the Event ID as a positional parameter. (By default, the Event ID appears in blue, in []'s at the left.) You can provide filters to narrow down by name (e.g., http, net, fs, or console), or by field (e.g., fs.open, stdout, or net.open). You can use JavaScript expressions to further refine the query, and to express logic.

\n

Usage

\n

scope events [flags] ([eventId])

\n

Examples

\n
Examples:\nscope events\nscope events m61\nscope events --sourcetype http\nscope events --source stderr\nscope events --match file\nscope events --fields net_bytes_sent,net_bytes_recv --match net_bytes\nscope events --follow\nscope events --all\nscope events --allfields\nscope events --id 4\nscope events --sort _time --reverse\nscope events --eval 'sourcetype!=\"net\"'\nscope events -n 1000 -e 'sourcetype!=\"console\" && source.indexOf(\"cribl.log\") == -1 && (data[\"file.name\"] || \"\").indexOf(\"/proc\") == -1'\n
\n

Flags

\n
  -a, --all                  Show all events\n      --allfields            Displaying hidden fields\n      --color                Force color on (if tty detection fails or piping)\n  -e, --eval string          Evaluate JavaScript expression against event. Must return truthy to print event.\n                             Note: Post-processes after matching, not guaranteed to return last <n> events.\n      --fields strings       Display the names and values for specified fields only, for each event (look at JSON output for field names)\n  -f, --follow               Follow a file, like tail -f\n  -h, --help                 help for events\n  -i, --id int               Display info from specific from session ID (default -1)\n  -j, --json                 Output as newline delimited JSON\n  -n, --last int             Show last <n> events (default 20)\n  -m, --match string         Display events containing supplied string\n  -r, --reverse              Reverse sort to ascending. Must be combined with --sort\n      --sort string          Sort descending by field (look at JSON output for field names)\n  -s, --source strings       Display events matching supplied sources\n  -t, --sourcetype strings   Display events matching supplied sourcetypes\n
\n

extract

\n
\n

Outputs libscope.so and scope.yml to the provided directory. You can configure these files to instrument any application, and to output the data to any existing tool using simple TCP protocols.

\n

The --*dest flags accept file names like /tmp/scope.log or URLs like file:///tmp/scope.log. They may also\nbe set to sockets with unix:///var/run/mysock, tcp://hostname:port, udp://hostname:port, or tls://hostname:port.

\n

Usage

\n

scope extract [flags] (<dir>)

\n

Aliases

\n

extract, excrete, expunge, extricate, exorcise

\n

Examples

\n
scope extract\nscope extract /opt/libscope\nscope extract --metricdest tcp://some.host:8125 --eventdest tcp://other.host:10070 .\n
\n

Flags

\n
  -a, --authtoken string      Set AuthToken for Cribl\n  -c, --cribldest string      Set Cribl destination for metrics & events (host:port defaults to tls://)\n  -e, --eventdest string      Set destination for events (host:port defaults to tls://)\n  -h, --help                  Help for extract\n  -m, --metricdest string     Set destination for metrics (host:port defaults to tls://)\n      --metricformat string   Set format of metrics output (statsd|ndjson); default is \"ndjson\"\n      --metricprefix string   Set prefix for StatsD metrics, ignored if metric format isn't statsd\n  -n, --nobreaker             Set Cribl to not break streams into events\n  -p, --parents               Create any missing intermediate pathname components in provided directory parameter\n
\n

rules

\n
\n

View or modify system-wide AppScope rules to automatically scope a set of processes. You can add or remove a single process at a time.

\n

Usage

\n

scope rules [flags]

\n

Examples

\n
scope rules\nscope rules --rootdir /path/to/host/root --json\nscope rules --add nginx\nscope rules --add nginx < scope.yml\nscope rules --add java --arg myServer \nscope rules --add firefox --rootdir /path/to/host/root\nscope rules --remove chromium\n
\n

Flags

\n
      --add string            Add an entry to the global rules\n      --arg string            Argument to the command to be added to the rules\n  -a, --authtoken string      Set AuthToken for Cribl\n  -b, --backtrace             Enable backtrace file generation when an application crashes.\n  -d, --coredump              Enable core dump file generation when an application crashes.\n  -c, --cribldest string      Set Cribl destination for metrics & events (host:port defaults to tls://)\n  -e, --eventdest string      Set destination for events (host:port defaults to tls://)\n  -h, --help                  help for rules\n  -j, --json                  Output as newline delimited JSON\n  -l, --librarypath string    Set path for dynamic libraries\n      --loglevel string       Set scope library log level (debug, warning, info, error, none)\n  -m, --metricdest string     Set destination for metrics (host:port defaults to tls://)\n      --metricformat string   Set format of metrics output (statsd|ndjson|prometheus) (default \"ndjson\")\n  -n, --nobreaker             Set Cribl to not break streams into events.\n  -p, --payloads              Capture payloads of network transactions\n      --remove string         Remove an entry from the global rules\n  -R, --rootdir string        Path to root filesystem of target namespace\n      --source string         Source identifier for a rules entry\n      --unixpath string       Path to the unix socket\n  -u, --userconfig string     Scope an application with a user specified config file; overrides all other settings.\n  -v, --verbosity int         Set scope metric verbosity (default 4)\n
\n

flows

\n
\n

Displays observed flows from the given session. If run with payload capture on, outputs full payloads from the flow.

\n

Usage

\n\n

scope flows [flags] <sessionId>

\n

Examples

\n
scope flows                # Displays all flows\nscope flows 124x3c         # Displays more info about the flow\nscope flows --in 124x3c    # Displays the inbound payload of that flow\nscope flows --out 124x3c   # Displays the outbound payload of that flow\nscope flows -p 0.0.0.0/24  # Displays flows in that subnet range\nscope flows --sort net_host_port --reverse  # Sort flows by ascending host port\n
\n

Flags

\n
  -a, --all           Show all flows\n  -h, --help          Help for flows\n  -i, --id int        Display flows from specific from session ID (default -1)\n      --in            Output contents of the inbound payload. Requires flow ID specified.\n  -j, --json          Output as newline-delimited JSON\n  -n, --last int      Show last <n> flows (default 20)\n      --out           Output contents of the outbound payload. Requires flow ID specified.\n  -p, --peer ipNet    Filter to peers in the given network\n  -r, --reverse       Reverse sort to ascending\n  -s, --sort string   Sort descending by field (look at JSON output for field names)\n
\n

help

\n
\n

Displays help content for any AppScope subcommand. Just type scope help [subcommand] for full details.

\n

Usage

\n

scope help [subcommand] [flags]

\n

Examples

\n

scope help run

\n

history

\n
\n

Prints information about sessions. Every time you scope a command, that is called an AppScope session. Each session has a directory which is referenced by a session ID. By default, the AppScope CLI stores all the information it collects during a given session in that session's directory. When you run history, you see a listing of sessions, one session per scoped command, along with information about when the session started, how many events were output during the session, and so on.

\n

Usage

\n

scope history [flags]

\n

Aliases

\n

history, hist

\n

Examples

\n
scope history                    # Displays session history\nscope hist                       # Shortcut for scope history\nscope hist -r                    # Displays running sessions\nscope hist --id 2                # Displays detailed information for session 2\nscope hist -n 50                 # Displays last 50 sessions\nscope hist -d                    # Displays directory for the last session\ncat $(scope hist -d)/args.json   # Outputs contents of args.json in the scope history directory for the current session\n
\n

Flags

\n
  -a, --all        List all sessions\n  -d, --dir        Output just directory (with -i)\n  -h, --help       Help for history\n  -i, --id int     Display info from specific from session ID (default -1)\n  -n, --last int   Show last <n> sessions (default 20)\n  -r, --running    List running sessions\n
\n

inspect

\n
\n

Returns information on scoped process identified by PID.

\n

Usage

\n

scope inspect [flags]

\n

Examples

\n
scope inspect\nscope inspect 1000\nscope inspect --all --json\nscope inspect 1000 --rootdir /path/to/host/mount\nscope inspect --all --rootdir /path/to/host/mount\nscope inspect --all --rootdir /path/to/host/mount/proc/<hostpid>/root\n
\n

Flags

\n
  -a, --all             Inspect all processes\n  -h, --help            Help for inspect\n  -j, --json            Output as newline delimited JSON without pretty printing\n  -R, --rootdir         Path to root filesystem of target namespace\n
\n

k8s

\n
\n

Prints configurations to pass to kubectl, which then automatically instruments newly-launched containers. This installs a mutating admission webhook, which adds an initContainer to each pod. The webhook also sets environment variables that install AppScope for all processes in that container.

\n

The --*dest flags accept file names like /tmp/scope.log; URLs like file:///tmp/scope.log; or sockets specified with the pattern unix:///var/run/mysock, tcp://hostname:port, udp://hostname:port, or tls://hostname:port.

\n

Usage

\n

scope k8s [flags]

\n

Examples

\n
scope k8s --metricdest tcp://some.host:8125 --eventdest tcp://other.host:10070 | kubectl apply -f -\nkubectl label namespace default scope=enabled\n
\n

Flags

\n
      --app string            Name of the app in Kubernetes (default \"scope\")\n  -a, --authtoken string      Set AuthToken for Cribl Stream\n      --certfile string       Certificate file for TLS in the container (mounted secret) (default \"/etc/certs/tls.crt\")\n  -c, --cribldest string      Set Cribl Stream destination for metrics & events (host:port defaults to tls://)\n      --debug                 Turn on debug logging in the scope webhook container\n  -e, --eventdest string      Set destination for events (host:port defaults to tls://)\n  -h, --help                  Help for k8s\n      --keyfile string        Private key file for TLS in the container (mounted secret) (default \"/etc/certs/tls.key\")\n  -m, --metricdest string     Set destination for metrics (host:port defaults to tls://)\n      --metricformat string   Set format of metrics output (statsd|ndjson); default is \"ndjson\"\n      --metricprefix string   Set prefix for StatsD metrics, ignored if metric format isn't statsd\n      --namespace string      Name of the namespace in which to install; default is \"default\"\n  -n, --nobreaker             Set Cribl Stream to not break streams into events\n      --noexporter            Disable StatsD to Prometheus Exporter deployment\n      --port int              Port to listen on (default 4443)\n      --promport int          Specify StatsD to Prometheus Exporter port for Prometheus HTTP metrics requests (default 9090)\n      --server                Run Webhook server\n      --signername string     Name of the signer used to sign the certificate request for the AppScope Admission Webhook (default \"kubernetes.io/kubelet-serving\")\n      --version string        Version of scope to deploy\n
\n

logs

\n
\n

Displays internal AppScope logs for troubleshooting AppScope itself.

\n

Usage

\n

scope logs [flags]

\n

Examples

\n
scope logs\n
\n

Flags

\n
  -h, --help             Help for logs\n  -i, --id int           Display logs from specific from session ID (default -1)\n  -n, --last int         Show last <n> lines (default 20)\n  -s, --scope            Show scope.log (from CLI) instead of ldscope.log (from library)\n  -S, --service string   Display logs from a systemd service instead of a session\n \n
\n

metrics

\n
\n

Outputs metrics for a session.

\n

Usage

\n

scope metrics [flags]

\n

Examples

\n
scope metrics\nscope metrics -m net.error,fs.error\nscope metrics -m net.tx -g\n
\n

Flags

\n
  -c, --cols             Display metrics as columns. Must be combined with -m\n  -g, --graph            Graph this metric. Must be combined with -m\n  -h, --help             Help for metrics\n  -i, --id int           Display info from specific from session ID (default -1)\n  -m, --metric strings   Display for specified metrics only (comma-separated)\n  -u, --uniq             Display first instance of each unique metric\n
\n

prune

\n
\n

Prunes (deletes) one or more sessions from the history.

\n

Usage

\n

scope prune [flags]

\n

Examples

\n
scope prune -k 20\nscope prune -a\nscope prune -d 1\n
\n

Flags

\n

Negative arguments are not allowed.

\n
  -a, --all          Delete all sessions\n  -d, --delete int   Delete last <n> sessions\n  -f, --force        Do not prompt for confirmation\n  -h, --help         Help for prune\n  -k, --keep int     Keep last <n> sessions, delete all others\n
\n

ps

\n
\n

Lists all scoped processes. This means processes whose functions AppScope is interposing (which means that the AppScope library was loaded, and the AppScope reporting thread is running, in those processes, too).

\n

Usage

\n

scope ps

\n

Examples

\n
scope ps\nscope ps --json\nscope ps --rootdir /path/to/host/mount\nscope ps --rootdir /path/to/host/mount/proc/<hostpid>/root`,\n
\n

Flags

\n
  -j, --json            Output as newline delimited JSON without pretty printing\n  -R, --rootdir         Path to root filesystem of target namespace\n
\n

run

\n
\n

Executes a scoped command. By default, calling scope with no subcommands will run the executables you pass as arguments to\nscope. However, scope allows for additional arguments to be passed to run, to capture payloads or to increase metrics'\nverbosity. Must be called with the -- flag, e.g., scope run -- <command>, to prevent AppScope from attempting to parse flags passed to the executed command.

\n

The --*dest flags accept file names like /tmp/scope.log; URLs like file:///tmp/scope.log; or sockets specified with the pattern unix:///var/run/mysock, tcp://hostname:port, udp://hostname:port, or tls://hostname:port.

\n

Usage

\n

scope run [flags] [command]

\n

Examples

\n
scope run -- /bin/echo \"foo\"\nscope run -- perl -e 'print \"foo\\n\"'\nscope run --payloads -- nc -lp 10001\nscope run -- curl https://wttr.in/94105\nscope run -c tcp://127.0.0.1:10091 -- curl https://wttr.in/94105\nscope run -c edge -- top\n
\n

Flags

\n
  -a, --authtoken string      Set AuthToken for Cribl\n  -b, --backtrace             Enable backtrace file generation when an application crashes.\n  -d, --coredump              Enable core dump file generation when an application crashes.\n  -c, --cribldest string      Set Cribl destination for metrics & events (host:port defaults to tls://)\n  -e, --eventdest string      Set destination for events (host:port defaults to tls://)\n  -h, --help                  help for run\n  -l, --librarypath string    Set path for dynamic libraries\n      --loglevel string       Set scope library log level (debug, warning, info, error, none)\n  -m, --metricdest string     Set destination for metrics (host:port defaults to tls://)\n      --metricformat string   Set format of metrics output (statsd|ndjson) (default \"ndjson\")\n      --metricprefix string   Set prefix for StatsD metrics, ignored if metric format isn't statsd\n  -n, --nobreaker             Set Cribl to not break streams into events.\n  -p, --payloads              Capture payloads of network transactions\n  -u, --userconfig string     Scope an application with a user specified config file; overrides all other settings.\n  -v, --verbosity int         Set scope metric verbosity (default 4)\n
\n

service

\n
\n

Configures the specified systemd/OpenRC service to be scoped upon starting.

\n

Usage

\n

scope service SERVICE [flags]

\n

Examples

\n
scope service cribl -c tls://in.my-instance.cribl.cloud:10090\n
\n

Flags

\n
  -a, --authtoken string      Set AuthToken for Cribl Stream\n  -c, --cribldest string      Set Cribl Stream destination for metrics & events (host:port defaults to tls://)\n  -e, --eventdest string      Set destination for events (host:port defaults to tls://)\n      --force                 Bypass confirmation prompt\n  -h, --help                  Help for service\n  -m, --metricdest string     Set destination for metrics (host:port defaults to tls://)\n      --metricformat string   Set format of metrics output (statsd|ndjson); default is \"ndjson\"\n      --metricprefix string   Set prefix for StatsD metrics, ignored if metric format isn't statsd\n  -n, --nobreaker             Set Cribl Stream to not break streams into events\n  -u, --user string           Specify owner username\n  \n
\n

snapshot

\n
\n

Create a snapshot for a process. Snapshot file/s will be created in /tmp/appscope/[PID]/.

\n

Usage

\n

scope snapshot [PID] [flags]

\n

Flags

\n

-h, --help help for snapshot

\n

start

\n
\n

Install the AppScope library to:\n/usr/lib/appscope// with admin privileges, or\n/tmp/appscope// otherwise

\n

Usage

\n

scope start [flags]

\n

Examples

\n
scope start\nscope start --rootdir /hostfs\n
\n

Flags

\n
  -h, --help             help for start\n  -p, --rootdir string   Path to root filesystem of target namespace\n
\n

stop

\n
\n

Performs the following actions:\n- Removal of /etc/ld.so.preload contents\n- Removal of the rules file from /usr/lib/appscope/scope_rules\n- Detach from all currently scoped processes

\n

The command does not uninstall scope or libscope from /usr/lib/appscope or /tmp/appscope\nor remove any service configurations.

\n

Usage

\n

scope stop [flags]

\n

Examples

\n

scope stop

\n

Flags

\n
  -f, --force      Use this flag when you're sure you want to run scope stop\n  -R, --rootdir    Path to root filesystem of target namespace\n  -h, --help       help for stop\n
\n

update

\n
\n

Updates configuration of scoped process identified by PID.

\n

Usage

\n

scope update [flags]

\n

Examples

\n
scope update 1000 --config scope_cfg.yml\nscope update 1000 < scope_cfg.yml\nscope update 1000 --json < scope_cfg.yml\nscope update 1000 --rootdir /path/to/host/mount --config scope_cfg.yml\nscope update 1000 --rootdir /path/to/host/mount/proc/<hostpid>/root < scope_cfg.yml\n
\n

Flags

\n
Flags:\n  -i, --inspect         Inspect the process after the update is complete\n  -c, --config string   Path to configuration file\n  -h, --help            help for update\n  -j, --json            Output as newline delimited JSON without pretty printing\n  -R, --rootdir         Path to root filesystem of target namespace\n
\n

version

\n
\n

Outputs version info.

\n

Usage

\n

scope version [flags]

\n

Examples

\n
scope version\nscope version --date\nscope version --summary\nscope version --tag\n
\n

Flags

\n
      --date      Output just the date\n  -h, --help      Help for version\n      --summary   Output just the summary\n      --tag       Output just the tag\n
\n

watch

\n
\n

Executes a scoped command on an interval. Must be called with the -- flag, e.g., scope watch -- <command>, to prevent AppScope from attempting to parse flags passed to the executed command.

\n

Usage

\n

scope watch [flags]

\n

Examples

\n
scope watch -i 5s -- /bin/echo \"foo\"\nscope watch --interval=1m-- perl -e 'print \"foo\\n\"'\nscope watch --interval=5s --payloads -- nc -lp 10001\nscope watch -i 1h -- curl https://wttr.in/94105\nscope watch --interval=10s -- curl https://wttr.in/94105\n
\n

Flags

\n
  -a, --authtoken string      Set AuthToken for Cribl\n  -b, --backtrace             Enable backtrace file generation when an application crashes.\n  -d, --coredump              Enable core dump file generation when an application crashes.\n  -c, --cribldest string      Set Cribl destination for metrics & events (host:port defaults to tls://)\n  -e, --eventdest string      Set destination for events (host:port defaults to tls://)\n  -h, --help                  help for watch\n  -i, --interval string       Run every <x>(s|m|h)\n  -l, --librarypath string    Set path for dynamic libraries\n      --loglevel string       Set scope library log level (debug, warning, info, error, none)\n  -m, --metricdest string     Set destination for metrics (host:port defaults to tls://)\n      --metricformat string   Set format of metrics output (statsd|ndjson) (default \"ndjson\")\n      --metricprefix string   Set prefix for StatsD metrics, ignored if metric format isn't statsd\n  -n, --nobreaker             Set Cribl to not break streams into events.\n  -p, --payloads              Capture payloads of network transactions\n  -u, --userconfig string     Scope an application with a user specified config file; overrides all other settings.\n  -v, --verbosity int         Set scope metric verbosity (default 4)\n
","frontmatter":{"title":"CLI Reference"}}},"pageContext":{"slug":"/cli-reference/","id":"50a43c7b-9afa-5d49-a964-794c97b85fcf"}},"staticQueryHashes":["2787008656","306729481","625673991","640077088"]}