In AppScope, events are structured according to one pattern, and metrics are structured according to another. These patterns are defined rigorously, in validatable JSON Schema.
\nThree definitions schemas govern the basic patterns. Then there is an individual schema for each event and metric, documented below. The definitions schemas define the elements that can be present in individual event and metric schemas, as well as the overall structures into which those elements fit.
\nWhen we say \"the AppScope schema,\" we mean the whole set of schemas. The AppScope schema now in use was introduced in AppScope 1.0.1.
\nA few event and metric schema elements, namely title and description, have placeholder values. In the future, we might make these more informative. They are essentially \"internal documentation\" within the schemas and do not affect how the schemas function in AppScope. In the event that you develop any code that depends on AppScope schemas, be aware that the content of title and description fields may evolve.
For more about how events and metrics work in AppScope, see this overview.
\nFilesystem
\n\nNetwork
\nHTTP
\n\nDNS
\n\nFile
\nConsole
\nSystem Notification
\nStart Message
\nFilesystem
\n\nNetwork
\nHTTP
\nDNS
\nProcess
\n\nStructure of the console event
{\n \"type\": \"evt\",\n \"id\": \"eaf4d0598443-a.out-./a.out\",\n \"_channel\": \"8499188821284\",\n \"body\": {\n \"sourcetype\": \"console\",\n \"_time\": 1643883251.376672,\n \"source\": \"stderr\",\n \"host\": \"eaf4d0598443\",\n \"proc\": \"a.out\",\n \"cmd\": \"./a.out\",\n \"pid\": 986,\n \"data\": {\n \"message\": \"stderr hello world\"\n }\n }\n}\n{\n \"type\": \"evt\",\n \"id\": \"ubuntu-sh- /usr/bin/which /usr/bin/firefox\",\n \"_channel\": \"13468365092424\",\n \"body\": {\n \"sourcetype\": \"console\",\n \"_time\": 1643735941.602952,\n \"source\": \"stdout\",\n \"host\": \"ubuntu\",\n \"proc\": \"sh\",\n \"cmd\": \"/bin/sh /usr/bin/which /usr/bin/firefox\",\n \"pid\": 6545,\n \"data\": {\n \"message\": \"/usr/bin/firefox\\n\"\n }\n }\n}\nconsole properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
console.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is console. Value must be console. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nSpecifies whether AppScope is capturing either stderr or stdout from console.Possible values:
| \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
console.body.data properties| Property | \nDescription | \n
|---|---|
message (string) | \nThe textual data written to a console or file. | \n
Structure of the dns.req event
{\n \"type\": \"evt\",\n \"id\": \"ubuntu-firefox-/usr/lib/firefox/firefox\",\n \"_channel\": \"13470757294558\",\n \"body\": {\n \"sourcetype\": \"dns\",\n \"_time\": 1643735942.526987,\n \"source\": \"dns.req\",\n \"host\": \"ubuntu\",\n \"proc\": \"firefox\",\n \"cmd\": \"/usr/lib/firefox/firefox\",\n \"pid\": 6544,\n \"data\": {\n \"domain\": \"detectportal.firefox.com\"\n }\n }\n}\ndns.req properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
dns.req.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is DNS. Value must be dns. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a Network DNS operation. Value must be dns.req. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
dns.req.body.data properties| Property | \nDescription | \n
|---|---|
domain required (string) | \nThe domain for which the scoped app made a DNS request. | \n
Structure of the dns.resp event
{\n \"type\": \"evt\",\n \"id\": \"ubuntu-firefox-/usr/lib/firefox/firefox\",\n \"_channel\": \"13470823778038\",\n \"body\": {\n \"sourcetype\": \"dns\",\n \"_time\": 1643735942.552667,\n \"source\": \"dns.resp\",\n \"host\": \"ubuntu\",\n \"proc\": \"firefox\",\n \"cmd\": \"/usr/lib/firefox/firefox\",\n \"pid\": 6544,\n \"data\": {\n \"duration\": 25,\n \"domain\": \"detectportal.firefox.com\",\n \"addrs\": [\n \"34.107.221.82\"\n ]\n }\n }\n}\ndns.resp properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
dns.resp.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is DNS. Value must be dns. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a DNS response operation . Value must be dns.resp. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
dns.resp.body.data properties| Property | \nDescription | \n
|---|---|
duration (number) | \nDuration in milliseconds. Example: 55 | \n
domain (string) | \nThe domain for which the scoped app made a DNS request. | \n
addrs (array) | \nIP address(es) of the domain for which the scoped app sent a DNS request. | \n
Structure of the file event
{\n \"type\": \"evt\",\n \"id\": \"ubuntu-sh- /usr/bin/which /usr/bin/firefox\",\n \"_channel\": \"13468365092424\",\n \"body\": {\n \"sourcetype\": \"file\",\n \"_time\": 1643735941.602952,\n \"source\": \"/var/log/firefox.log\",\n \"host\": \"ubuntu\",\n \"proc\": \"sh\",\n \"cmd\": \"/bin/sh /usr/bin/which /usr/bin/firefox\",\n \"pid\": 6545,\n \"data\": {\n \"message\": \"/usr/bin/firefox\\n\"\n }\n }\n}\nfile properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
file.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is file. Value must be file. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nString that describes a file path. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
file.body.data properties| Property | \nDescription | \n
|---|---|
message (string) | \nThe textual data written to a console or file. | \n
Structure of the fs.close event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"5890090429747\",\n \"body\": {\n \"sourcetype\": \"fs\",\n \"_time\": 1643735835.455002,\n \"source\": \"fs.close\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1933,\n \"data\": {\n \"proc\": \"accept01\",\n \"pid\": 1933,\n \"host\": \"8bc1398c19f3\",\n \"file\": \"/dev/shm/ltp_accept01_1931\",\n \"proc_uid\": 0,\n \"proc_gid\": 0,\n \"proc_cgroup\": \"0::/system.slice/containerd.service\",\n \"file_perms\": 600,\n \"file_owner\": 0,\n \"file_group\": 0,\n \"file_read_bytes\": 0,\n \"file_read_ops\": 0,\n \"file_write_bytes\": 0,\n \"file_write_ops\": 0,\n \"duration\": 0,\n \"op\": \"close\"\n }\n }\n}\nfs.close properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
fs.close.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is filesystem. Value must be fs. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a File Close operation. Value must be fs.close. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
fs.close.body.data properties| Property | \nDescription | \n
|---|---|
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host (string) | \nHostname for the host on which the scoped app was run. | \n
file (string) | \nThe name of the file. | \n
proc_uid (integer) | \nThe user ID of the user who started the scoped app. Example: 0 | \n
proc_gid (integer) | \nThe group ID of the user who started the scoped app. Example: 0 | \n
proc_cgroup (string) | \nThe control group used in container creation. Example: 0::/user.slice/user-1000.slice/session-3.scope | \n
file_perms (integer) | \nThe permissions of the file, in octal format. Example: 777 | \n
file_owner (number) | \nThe user ID of the file owner. Example: 0 | \n
file_group (number) | \nThe group ID of the file owner. Example: 0 | \n
file_read_bytes (integer) | \nThe number of bytes of data read from a file. Example: 512 | \n
file_read_ops (integer) | \nCount of individual read operations aggregated. Example: 5 | \n
file_write_bytes (integer) | \nThe number of bytes of data written to a file. Example: 10 | \n
file_write_ops (integer) | \nCount of individual write operations aggregated. Example: 5 | \n
duration (number) | \nDuration in milliseconds. Example: 55 | \n
op (string) | \nThe close operation that was executed on the filesystem. Possible values:
| \n
Structure of the fs.delete event
{\n \"type\": \"evt\",\n \"id\": \"b6209181773f-rm-rm test.txt\",\n \"_channel\": \"none\",\n \"body\": {\n \"sourcetype\": \"fs\",\n \"_time\": 1643793922.040438,\n \"source\": \"fs.delete\",\n \"host\": \"b6209181773f\",\n \"proc\": \"rm\",\n \"cmd\": \"rm test.txt\",\n \"pid\": 306,\n \"data\": {\n \"proc\": \"rm\",\n \"pid\": 306,\n \"host\": \"b6209181773f\",\n \"op\": \"unlinkat\",\n \"file\": \"test.txt\",\n \"unit\": \"operation\"\n }\n }\n}\nfs.delete properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
fs.delete.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is filesystem. Value must be fs. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a File Delete operation. Value must be fs.delete. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
fs.delete.body.data properties| Property | \nDescription | \n
|---|---|
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe delete operation that was executed on the filesystem. Possible values:
| \n
file (string) | \nThe name of the file. | \n
unit (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
Structure of the fs.duration event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"5890091215105\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735835.455057,\n \"source\": \"fs.duration\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1933,\n \"data\": {\n \"_metric\": \"fs.duration\",\n \"_metric_type\": \"histogram\",\n \"_value\": 12,\n \"proc\": \"accept01\",\n \"pid\": 1933,\n \"fd\": 3,\n \"op\": \"fgets_unlocked\",\n \"file\": \"/etc/passwd\",\n \"numops\": 1,\n \"unit\": \"microsecond\"\n }\n }\n}\nfs.duration properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
fs.duration.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a File Duration operation. Value must be fs.duration. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
fs.duration.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a File Duration operation. Value must be fs.duration. | \n
_metric_type (string) | \nIndicates that the metric from the scoped app is a histogram. Value must be histogram. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
op (string) | \nThe function that was executed. | \n
file (string) | \nThe name of the file. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit (string) | \nIndicates that the metric's value is in microseconds. Value must be microsecond. | \n
Structure of the fs.error event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"5890094642989\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735835.45777,\n \"source\": \"fs.error\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1931,\n \"data\": {\n \"_metric\": \"fs.error\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 1931,\n \"op\": \"access\",\n \"file\": \"/dev/shm/ltp_accept01_1931\",\n \"class\": \"stat\",\n \"unit\": \"operation\"\n }\n }\n}\nfs.error properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
fs.error.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a File Error operation. Value must be fs.error. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
fs.error.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a File Error operation. Value must be fs.error. | \n
_metric_type (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
op (string) | \nThe function that was executed. | \n
file (string) | \nThe name of the file. | \n
class (string) | \nSubcategory of filesystem error. Possible values:
| \n
unit (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
Structure of the fs.open event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"5890090429747\",\n \"body\": {\n \"sourcetype\": \"fs\",\n \"_time\": 1643735835.454946,\n \"source\": \"fs.open\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1933,\n \"data\": {\n \"proc\": \"accept01\",\n \"pid\": 1933,\n \"host\": \"8bc1398c19f3\",\n \"file\": \"/dev/shm/ltp_accept01_1931\",\n \"proc_uid\": 0,\n \"proc_gid\": 0,\n \"proc_cgroup\": \"0::/system.slice/containerd.service\",\n \"file_perms\": 600,\n \"file_owner\": 0,\n \"file_group\": 0,\n \"op\": \"open\"\n }\n }\n}\nfs.open properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
fs.open.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is filesystem. Value must be fs. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a File open operation. Value must be fs.open. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
fs.open.body.data properties| Property | \nDescription | \n
|---|---|
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host (string) | \nHostname for the host on which the scoped app was run. | \n
file (string) | \nThe name of the file. | \n
proc_uid (integer) | \nThe user ID of the user who started the scoped app. Example: 0 | \n
proc_gid (integer) | \nThe group ID of the user who started the scoped app. Example: 0 | \n
proc_cgroup (string) | \nThe control group used in container creation. Example: 0::/user.slice/user-1000.slice/session-3.scope | \n
file_perms (integer) | \nThe permissions of the file, in octal format. Example: 777 | \n
file_owner (number) | \nThe user ID of the file owner. Example: 0 | \n
file_group (number) | \nThe group ID of the file owner. Example: 0 | \n
op (string) | \nThe open operation that was executed on the filesystem. Possible values:
| \n
Structure of the fs.read event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"5890091215105\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735835.455076,\n \"source\": \"fs.read\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1933,\n \"data\": {\n \"_metric\": \"fs.read\",\n \"_metric_type\": \"histogram\",\n \"_value\": 4096,\n \"proc\": \"accept01\",\n \"pid\": 1933,\n \"fd\": 3,\n \"op\": \"fgets_unlocked\",\n \"file\": \"/etc/passwd\",\n \"numops\": 1,\n \"unit\": \"byte\"\n }\n }\n}\nfs.read properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
fs.read.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a File Read operation. Value must be fs.read. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
fs.read.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a File Read operation. Value must be fs.read. | \n
_metric_type (string) | \nIndicates that the metric from the scoped app is a histogram. Value must be histogram. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
op (string) | \nThe read operation that was executed on the filesystem. Possible values:
| \n
file (string) | \nThe name of the file. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
Structure of the fs.seek event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-sh-/bin/sh ./file_x\",\n \"_channel\": \"5891441789884\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735836.805196,\n \"source\": \"fs.seek\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"sh\",\n \"cmd\": \"/bin/sh ./file_x\",\n \"pid\": 2061,\n \"data\": {\n \"_metric\": \"fs.seek\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"sh\",\n \"pid\": 2061,\n \"fd\": 3,\n \"op\": \"lseek\",\n \"file\": \"./file_x\",\n \"unit\": \"operation\"\n }\n }\n}\nfs.seek properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
fs.seek.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a File Seek operation. Value must be fs.seek. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
fs.seek.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a File Seek operation. Value must be fs.seek. | \n
_metric_type (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
op (string) | \nThe seek operation that was executed on the filesystem. Possible values:
| \n
file (string) | \nThe name of the file. | \n
unit (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
Structure of the fs.stat event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"5890091777333\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735835.454905,\n \"source\": \"fs.stat\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1933,\n \"data\": {\n \"_metric\": \"fs.stat\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 1933,\n \"op\": \"access\",\n \"file\": \"/dev/shm\",\n \"unit\": \"operation\"\n }\n }\n}\nfs.stat properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
fs.stat.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a File Stat operation. Value must be fs.stat. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
fs.stat.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a File Stat operation. Value must be fs.stat. | \n
_metric_type (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
op (string) | \nThe stat operation that was executed on the filesystem. Possible values:
| \n
file (string) | \nThe name of the file. | \n
unit (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
Structure of the fs.write event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-access02-/kernel/syscalls/access/access02\",\n \"_channel\": \"5891407740765\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735836.773249,\n \"source\": \"fs.write\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"access02\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/access/access02\",\n \"pid\": 2058,\n \"data\": {\n \"_metric\": \"fs.write\",\n \"_metric_type\": \"histogram\",\n \"_value\": 10,\n \"proc\": \"access02\",\n \"pid\": 2058,\n \"fd\": 3,\n \"op\": \"__write_libc\",\n \"file\": \"file_x\",\n \"numops\": 1,\n \"unit\": \"byte\"\n }\n }\n}\nfs.write properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
fs.write.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a File Write operation. Value must be fs.write. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
fs.write.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a File Write operation. Value must be fs.write. | \n
_metric_type (string) | \nIndicates that the metric from the scoped app is a histogram. Value must be histogram. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
op (string) | \nThe write operation that was executed on the filesystem. Possible values:
| \n
file (string) | \nThe name of the file. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
Structure of the http.req event
{\n \"type\": \"evt\",\n \"id\": \"ubuntu-firefox-/usr/lib/firefox/firefox\",\n \"_channel\": \"13470846442500\",\n \"body\": {\n \"sourcetype\": \"http\",\n \"_time\": 1643735942.588626,\n \"source\": \"http.req\",\n \"host\": \"ubuntu\",\n \"proc\": \"firefox\",\n \"cmd\": \"/usr/lib/firefox/firefox\",\n \"pid\": 6544,\n \"data\": {\n \"http_method\": \"GET\",\n \"http_target\": \"/canonical.html\",\n \"http_flavor\": \"1.1\",\n \"http_scheme\": \"http\",\n \"http_host\": \"detectportal.firefox.com\",\n \"http_user_agent\": \"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\",\n \"net_transport\": \"IP.TCP\",\n \"net_peer_ip\": \"34.107.221.82\",\n \"net_peer_port\": 80,\n \"net_host_ip\": \"172.16.198.210\",\n \"net_host_port\": 33712\n }\n }\n}\nhttp.req properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
http.req.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is HTTP. Value must be http. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the event Source is an HTTP request. Value must be http.req. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
http.req.body.data properties| Property | \nDescription | \n
|---|---|
http_method (string) | \nSpecifies the method of an HTTP request in the data; e.g., GET, POST, PATCH, etc. | \n
http_frame (string) | \nType of the HTTP/2 frame as described in RFC 7540. Possible values:
| \n
http_target (string) | \nIn a URL, the path or file after the FQDN. | \n
http_flavor (string) | \nSpecifies whether an HTTP request or response is in HTTP/1.1 or HTTP/2.0. | \n
http_stream (integer) | \nHTTP/2 Stream Identifier. | \n
http_scheme (string) | \nSpecifies whether data was unencrypted (HTTP) or encrypted (HTTPS). Possible values:
| \n
http_host (string) | \nHostname of the host to which an HTTP request was sent; or, from which a response was received. | \n
http_user_agent (string) | \nHTTP header property describing the web client. | \n
http_client_ip (string) | \nIP address of the host that issued an HTTP request or received the response. | \n
net_transport (string) | \nNetwork layer used (before the dot) and transport layer used (after the dot). Possible values:
| \n
net_peer_ip (string) | \nThe IP address portion of the remote side of a network connection. | \n
net_peer_port (integer) | \nThe port portion of the remote side of a network connection. | \n
net_host_ip (string) | \nThe IP address portion of the local side of a network connection. | \n
net_host_port (integer) | \nThe port portion of the local side of a network connection. | \n
x_appscope (string) | \nValue of the x-appscope HTTP header (if present).Value must be x-appscope. | \n
Structure of the http.resp event
{\n \"type\": \"evt\",\n \"id\": \"ubuntu-firefox-/usr/lib/firefox/firefox\",\n \"_channel\": \"13470846442500\",\n \"body\": {\n \"sourcetype\": \"http\",\n \"_time\": 1643735942.613892,\n \"source\": \"http.resp\",\n \"host\": \"ubuntu\",\n \"proc\": \"firefox\",\n \"cmd\": \"/usr/lib/firefox/firefox\",\n \"pid\": 6544,\n \"data\": {\n \"http_method\": \"GET\",\n \"http_target\": \"/canonical.html\",\n \"http_scheme\": \"http\",\n \"http_flavor\": \"1.1\",\n \"http_status_code\": 200,\n \"http_status_text\": \"OK\",\n \"http_server_duration\": 26,\n \"http_host\": \"detectportal.firefox.com\",\n \"http_user_agent\": \"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\",\n \"net_transport\": \"IP.TCP\",\n \"net_peer_ip\": \"34.107.221.82\",\n \"net_peer_port\": 80,\n \"net_host_ip\": \"172.16.198.210\",\n \"net_host_port\": 33712,\n \"http_response_content_length\": 90\n }\n }\n}\nhttp.resp properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
http.resp.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is HTTP. Value must be http. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is an HTTP response. Value must be http.resp. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
http.resp.body.data properties| Property | \nDescription | \n
|---|---|
http_method (string) | \nSpecifies the method of an HTTP request in the data; e.g., GET, POST, PATCH, etc. | \n
http_target (string) | \nIn a URL, the path or file after the FQDN. | \n
http_stream (integer) | \nHTTP/2 Stream Identifier. | \n
http_scheme (string) | \nSpecifies whether data was unencrypted (HTTP) or encrypted (HTTPS). Possible values:
| \n
http_flavor (string) | \nSpecifies whether an HTTP request or response is in HTTP/1.1 or HTTP/2.0. | \n
http_status_code (integer) | \nSpecifies the status code of an HTTP response. Possible values:
| \n
http_status_text (string) | \nThe standard text that accompanies an HTTP response status code. Possible values:
| \n
http_client_duration (number) | \nTime elapsed between when a request was issued and when the response was received, in milliseconds. | \n
http_server_duration (number) | \nTime elapsed between when a request was received and when the response was issued, in milliseconds. | \n
http_host (string) | \nHostname of the host to which an HTTP request was sent; or, from which a response was received. | \n
http_user_agent (string) | \nHTTP header property describing the web client. | \n
net_transport (string) | \nNetwork layer used (before the dot) and transport layer used (after the dot). Possible values:
| \n
net_peer_ip (string) | \nThe IP address portion of the remote side of a network connection. | \n
net_peer_port (integer) | \nThe port portion of the remote side of a network connection. | \n
net_host_ip (string) | \nThe IP address portion of the local side of a network connection. | \n
net_host_port (integer) | \nThe port portion of the local side of a network connection. | \n
http_response_content_length (number) | \nSpecifies the length in bytes of the HTTP response body. | \n
Structure of the net.app event
{\n \"type\": \"evt\",\n \"id\": \"ubuntu-firefox-/usr/lib/firefox/firefox\",\n \"_channel\": \"13470846442500\",\n \"body\": {\n \"sourcetype\": \"net\",\n \"_time\": 1643735942.588594,\n \"source\": \"net.app\",\n \"host\": \"ubuntu\",\n \"proc\": \"firefox\",\n \"cmd\": \"/usr/lib/firefox/firefox\",\n \"pid\": 6544,\n \"data\": {\n \"proc\": \"firefox\",\n \"pid\": 6544,\n \"fd\": 91,\n \"host\": \"ubuntu\",\n \"protocol\": \"HTTP\"\n }\n }\n}\nnet.app properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.app.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is net (meaning network). Value must be net. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a Network App (protocol detection) operation. Value must be net.app. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.app.body.data properties| Property | \nDescription | \n
|---|---|
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host (string) | \nHostname for the host on which the scoped app was run. | \n
protocol (string) | \nProtocol detected in data transmitted over a network connection. Possible values:
| \n
Structure of the net.close event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-recvfrom01-nel/syscalls/recvfrom/recvfrom01\",\n \"_channel\": \"5912618970557\",\n \"body\": {\n \"sourcetype\": \"net\",\n \"_time\": 1643735857.983449,\n \"source\": \"net.close\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"recvfrom01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/recvfrom/recvfrom01\",\n \"pid\": 3793,\n \"data\": {\n \"net_transport\": \"IP.TCP\",\n \"net_peer_ip\": \"0.0.0.0\",\n \"net_peer_port\": 35533,\n \"net_host_ip\": \"127.0.0.1\",\n \"net_host_port\": 40184,\n \"duration\": 0,\n \"net_bytes_sent\": 0,\n \"net_bytes_recv\": 6,\n \"net_close_reason\": \"local\"\n }\n }\n}\nnet.close properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.close.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is net (meaning network). Value must be net. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a Network Close operation. Value must be net.close. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.close.body.data properties| Property | \nDescription | \n
|---|---|
net_transport (string) | \nNetwork layer used (before the dot) and transport layer used (after the dot). Possible values:
| \n
net_peer_ip (string) | \nThe IP address portion of the remote side of a network connection. | \n
net_peer_port (integer) | \nThe port portion of the remote side of a network connection. | \n
net_host_ip (string) | \nThe IP address portion of the local side of a network connection. | \n
net_host_port (integer) | \nThe port portion of the local side of a network connection. | \n
net_protocol (string) | \nFirst network protocol detected from data sent or received. Value must be http. | \n
unix_peer_inode (number) | \nInode number for the remote end of a UNIX domain socket. | \n
unix_local_inode (number) | \nInode number for the local end of a UNIX domain socket. | \n
duration (number) | \nDuration in milliseconds. Example: 55 | \n
net_bytes_sent (number) | \nThe number of bytes of data sent over a network connection. | \n
net_bytes_recv (number) | \nThe number of bytes of data received over a network connection. | \n
net_close_reason (string) | \nSpecifies which end of a network connection initiated the closing of the connection. Possible values:
| \n
Structure of the net.duration event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-recvmsg01-ernel/syscalls/recvmsg/recvmsg01\",\n \"_channel\": \"5912681876432\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735858.046756,\n \"source\": \"net.duration\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"recvmsg01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/recvmsg/recvmsg01\",\n \"pid\": 3798,\n \"data\": {\n \"_metric\": \"net.duration\",\n \"_metric_type\": \"timer\",\n \"_value\": 1,\n \"proc\": \"recvmsg01\",\n \"pid\": 3798,\n \"fd\": 4,\n \"proto\": \"TCP\",\n \"port\": 41482,\n \"numops\": 1,\n \"unit\": \"millisecond\"\n }\n }\n}\nnet.duration properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.duration.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a counter that measures Network duration. Value must be net.duration. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.duration.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a counter that measures Network duration. Value must be net.duration. | \n
_metric_type (string) | \nIndicates that the metric is a timer. Value must be timer. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit (string) | \nIndicates that the metric's value is in milliseconds. Value must be millisecond. | \n
Structure of the net.error event
{\n \"type\": \"evt\",\n \"id\": \"90aac4bb0722-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"2745569202700291\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643972258.00885,\n \"source\": \"net.error\",\n \"host\": \"90aac4bb0722\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1934,\n \"data\": {\n \"_metric\": \"net.error\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 1934,\n \"op\": \"accept\",\n \"class\": \"connection\",\n \"unit\": \"operation\"\n }\n }\n}\nnet.error properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.error.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a Network Error operation. Value must be net.error. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.error.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a Network Error operation. Value must be net.error. | \n
_metric_type (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
op (string) | \nThe function that was executed. | \n
class (string) | \nSubcategory of network error. Value must be connection. | \n
unit (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
Structure of the net.open event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept02-/kernel/syscalls/accept/accept02\",\n \"_channel\": \"5890157346952\",\n \"body\": {\n \"sourcetype\": \"net\",\n \"_time\": 1643735835.521928,\n \"source\": \"net.open\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept02\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept02\",\n \"pid\": 1936,\n \"data\": {\n \"net_transport\": \"IP.TCP\",\n \"net_peer_ip\": \"127.0.0.1\",\n \"net_peer_port\": 58625,\n \"net_host_ip\": \"0.0.0.0\",\n \"net_host_port\": 0\n }\n }\n}\nnet.open properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.open.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is net (meaning network). Value must be net. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a Network Open operation. Value must be net.open. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.open.body.data properties| Property | \nDescription | \n
|---|---|
net_transport (string) | \nNetwork layer used (before the dot) and transport layer used (after the dot). Possible values:
| \n
net_peer_ip (string) | \nThe IP address portion of the remote side of a network connection. | \n
net_peer_port (integer) | \nThe port portion of the remote side of a network connection. | \n
net_host_ip (string) | \nThe IP address portion of the local side of a network connection. | \n
net_host_port (integer) | \nThe port portion of the local side of a network connection. | \n
unix_peer_inode (number) | \nInode number for the remote end of a UNIX domain socket. | \n
unix_local_inode (number) | \nInode number for the local end of a UNIX domain socket. | \n
net_protocol (string) | \nFirst network protocol detected from data sent or received. Value must be http. | \n
Structure of the net.other event
{\n \"type\": \"evt\",\n \"id\": \"test_user-server_seqpacket-./server_seqpacket\",\n \"_channel\": \"11977632602680\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643886739.820863,\n \"source\": \"net.other\",\n \"host\": \"test_user\",\n \"proc\": \"server_seqpacket\",\n \"cmd\": \"./server_seqpacket\",\n \"pid\": 232570,\n \"data\": {\n \"_metric\": \"net.other\",\n \"_metric_type\": \"gauge\",\n \"_value\": 1,\n \"proc\": \"server_seqpacket\",\n \"pid\": 232570,\n \"fd\": 3,\n \"proto\": \"SEQPACKET\",\n \"port\": 0,\n \"unit\": \"connection\"\n }\n }\n}\nnet.other properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.other.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a Network operation of an other-than-standard kind. Value must be net.other. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.other.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a Network operation of an other-than-standard kind. Value must be net.other. | \n
_metric_type (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit (string) | \nIndicates that the metric's value is a number of connections. Value must be connection. | \n
Structure of the net.port event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"5890091645261\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735835.455222,\n \"source\": \"net.port\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1933,\n \"data\": {\n \"_metric\": \"net.port\",\n \"_metric_type\": \"gauge\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 1933,\n \"fd\": 4,\n \"proto\": \"TCP\",\n \"port\": 0,\n \"unit\": \"instance\"\n }\n }\n}\nnet.port properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.port.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a gauge that identifies open ports. Value must be net.port. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.port.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a gauge that identifies open ports. Value must be net.port. | \n
_metric_type (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit (string) | \nIndicates that the metric's value is a number of instances. Value must be instance. | \n
Structure of the net.rx event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-recvfrom01-nel/syscalls/recvfrom/recvfrom01\",\n \"_channel\": \"5912618970557\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735857.983368,\n \"source\": \"net.rx\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"recvfrom01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/recvfrom/recvfrom01\",\n \"pid\": 3793,\n \"data\": {\n \"_metric\": \"net.rx\",\n \"_metric_type\": \"counter\",\n \"_value\": 6,\n \"proc\": \"recvfrom01\",\n \"pid\": 3793,\n \"fd\": 4,\n \"domain\": \"AF_INET\",\n \"proto\": \"TCP\",\n \"localip\": \"127.0.0.1\",\n \"localp\": 40184,\n \"remoteip\": \"0.0.0.0\",\n \"remotep\": 35533,\n \"data\": \"clear\",\n \"numops\": 1,\n \"unit\": \"byte\"\n }\n }\n}\nnet.rx properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.rx.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a Network receive operation. Value must be net.rx. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.rx.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a Network receive operation. Value must be net.rx. | \n
_metric_type (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
domain (string) | \nThe domain for which the scoped app made a DNS request. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
localip (string) | \nThe IP address portion of the local end of a network connection. Example: 127.0.0.1 | \n
localp (number) | \nThe port portion of the local end of a network connection. Example: 9109 | \n
localn (number) | \nInode number for the local end of a UNIX domain socket. | \n
remoteip (string) | \nIP address for the remote end of a network socket. Example: 192.158.1.38 | \n
remotep (number) | \nPort for the remote end of a network socket. Example: 9108 | \n
remoten (number) | \nInode number for the remote end of a UNIX domain socket. | \n
data (string) | \nSpecifies whether data was unencrypted (clear) or encrypted (SSL). Possible values:
| \n
numops (number) | \nCount of individual operations aggregated. | \n
unit (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
Structure of the net.tcp event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"5890091645261\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735835.455387,\n \"source\": \"net.tcp\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1933,\n \"data\": {\n \"_metric\": \"net.tcp\",\n \"_metric_type\": \"gauge\",\n \"_value\": 0,\n \"proc\": \"accept01\",\n \"pid\": 1933,\n \"fd\": 4,\n \"proto\": \"TCP\",\n \"port\": 0,\n \"unit\": \"connection\"\n }\n }\n}\nnet.tcp properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.tcp.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a gauge that shows the current count of open TCP ports. Value must be net.tcp. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.tcp.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a gauge that shows the current count of open TCP ports. Value must be net.tcp. | \n
_metric_type (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Value must be TCP. | \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit (string) | \nIndicates that the metric's value is a number of connections. Value must be connection. | \n
Structure of the net.tx event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-recvfrom01-nel/syscalls/recvfrom/recvfrom01\",\n \"_channel\": \"5912618642035\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735857.983059,\n \"source\": \"net.tx\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"recvfrom01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/recvfrom/recvfrom01\",\n \"pid\": 3795,\n \"data\": {\n \"_metric\": \"net.tx\",\n \"_metric_type\": \"counter\",\n \"_value\": 6,\n \"proc\": \"recvfrom01\",\n \"pid\": 3795,\n \"fd\": 4,\n \"domain\": \"AF_INET\",\n \"proto\": \"TCP\",\n \"localip\": \"0.0.0.0\",\n \"localp\": 0,\n \"remoteip\": \"127.0.0.1\",\n \"remotep\": 40184,\n \"data\": \"clear\",\n \"numops\": 1,\n \"unit\": \"byte\"\n }\n }\n}\nnet.tx properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.tx.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a Network transmit operation. Value must be net.tx. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.tx.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a Network transmit operation. Value must be net.tx. | \n
_metric_type (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
domain (string) | \nThe domain for which the scoped app made a DNS request. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
localip (string) | \nThe IP address portion of the local end of a network connection. Example: 127.0.0.1 | \n
localp (number) | \nThe port portion of the local end of a network connection. Example: 9109 | \n
localn (number) | \nInode number for the local end of a UNIX domain socket. | \n
remoteip (string) | \nIP address for the remote end of a network socket. Example: 192.158.1.38 | \n
remotep (number) | \nPort for the remote end of a network socket. Example: 9108 | \n
remoten (number) | \nInode number for the remote end of a UNIX domain socket. | \n
data (string) | \nSpecifies whether data was unencrypted (clear) or encrypted (SSL). Possible values:
| \n
numops (number) | \nCount of individual operations aggregated. | \n
unit (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
Structure of the net.udp event
{\n \"type\": \"evt\",\n \"id\": \"8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01\",\n \"_channel\": \"5890091656419\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643735835.455419,\n \"source\": \"net.udp\",\n \"host\": \"8bc1398c19f3\",\n \"proc\": \"accept01\",\n \"cmd\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"pid\": 1933,\n \"data\": {\n \"_metric\": \"net.udp\",\n \"_metric_type\": \"gauge\",\n \"_value\": 0,\n \"proc\": \"accept01\",\n \"pid\": 1933,\n \"fd\": 5,\n \"proto\": \"UDP\",\n \"port\": 0,\n \"unit\": \"connection\"\n }\n }\n}\nnet.udp properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
net.udp.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is a gauge that shows the current count of open UDP ports. Value must be net.udp. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (object) | \ndata Details below. | \n
net.udp.body.data properties| Property | \nDescription | \n
|---|---|
_metric (string) | \nIndicates that the Source is a gauge that shows the current count of open UDP ports. Value must be net.udp. | \n
_metric_type (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc (string) | \nThe name of the scoped app's process. | \n
pid (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Value must be UDP. | \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit (string) | \nIndicates that the metric's value is a number of connections. Value must be connection. | \n
Structure of the notice event
{\n \"type\": \"evt\",\n \"id\": \"9a721a6ad0be-htop-htop\",\n \"_channel\": \"13544129471303\",\n \"body\": {\n \"sourcetype\": \"metric\",\n \"_time\": 1643888296.317304,\n \"source\": \"notice\",\n \"host\": \"9a721a6ad0be\",\n \"proc\": \"htop\",\n \"cmd\": \"htop\",\n \"pid\": 302,\n \"data\": \"Truncated metrics. Your rate exceeded 10000 metrics per second\"\n }\n}\nnotice properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes events from metrics. Value must be evt. | \n
id required (string) | \nIdentifies the application that the process is associated with. | \n
_channel required (string) | \nIdentifies the operation during whose lifetime the event or metric is emitted. | \n
body required (object) | \nbody Details below. | \n
notice.body properties| Property | \nDescription | \n
|---|---|
sourcetype required (string) | \nIndicates that the Sourcetype is metric. Value must be metric. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
source required (string) | \nIndicates that the Source is an AppScope notification. Value must be notice. | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
data required (string) | \nThe data that the scoped app emitted as output. | \n
Structure of the process-start message
\n{\n \"format\": \"ndjson\",\n \"info\": {\n \"process\": {\n \"libscopever\": \"v1.3.0\",\n \"pid\": 35673,\n \"ppid\": 3390,\n \"gid\": 1000,\n \"groupname\": \"test_user\",\n \"uid\": 1000,\n \"username\": \"test_user\",\n \"hostname\": \"test_user\",\n \"procname\": \"ls\",\n \"cmd\": \"ls --color=auto\",\n \"id\": \"test_user-ls-ls --color=auto\",\n \"cgroup\": \"9:cpuset:/\",\n \"machine_id\": \"a1e2ada5a5b1b273b4b5c0c2c1c4f5d1\",\n \"uuid\": \"da845a9b-a55d-4c42-893d-08b54ee6e999\"\n },\n \"configuration\": {\n \"current\": {\n \"metric\": {\n \"enable\": \"true\",\n \"transport\": {\n \"type\": \"udp\",\n \"host\": \"127.0.0.1\",\n \"port\": \"8125\",\n \"tls\": {\n \"enable\": \"false\",\n \"validateserver\": \"true\",\n \"cacertpath\": \"\"\n }\n },\n \"format\": {\n \"type\": \"statsd\",\n \"statsdprefix\": \"\",\n \"statsdmaxlen\": 512,\n \"verbosity\": 4\n },\n \"watch\": [\n {\n \"type\": \"fs\"\n },\n {\n \"type\": \"net\"\n },\n {\n \"type\": \"http\"\n },\n {\n \"type\": \"dns\"\n },\n {\n \"type\": \"process\"\n },\n {\n \"type\": \"statsd\"\n }\n ]\n },\n \"libscope\": {\n \"log\": {\n \"level\": \"info\",\n \"transport\": {\n \"type\": \"file\",\n \"path\": \"/tmp/scope.log\",\n \"buffering\": \"line\"\n }\n },\n \"snapshot\": {\n \"coredump\": \"false\",\n \"backtrace\": \"false\"\n },\n \"configevent\": \"true\",\n \"summaryperiod\": 10,\n \"commanddir\": \"/tmp\"\n },\n \"event\": {\n \"enable\": \"true\",\n \"transport\": {\n \"type\": \"tcp\",\n \"host\": \"127.0.0.1\",\n \"port\": \"9109\",\n \"tls\": {\n \"enable\": \"false\",\n \"validateserver\": \"true\",\n \"cacertpath\": \"\"\n }\n },\n \"format\": {\n \"type\": \"ndjson\",\n \"maxeventpersec\": 10000,\n \"enhancefs\": \"true\"\n },\n \"watch\": [\n {\n \"type\": \"file\",\n \"name\": \"(\\\\/logs?\\\\/)|(\\\\.log$)|(\\\\.log[.\\\\d])\",\n \"field\": \".*\",\n \"value\": \".*\"\n },\n {\n \"type\": \"console\",\n \"name\": \"(stdout)|(stderr)\",\n \"field\": \".*\",\n \"value\": \".*\",\n \"allowbinary\": \"true\"\n },\n {\n \"type\": \"http\",\n \"name\": \".*\",\n \"field\": \".*\",\n \"value\": \".*\",\n \"headers\": []\n },\n {\n \"type\": \"net\",\n \"name\": \".*\",\n \"field\": \".*\",\n \"value\": \".*\"\n },\n {\n \"type\": \"fs\",\n \"name\": \".*\",\n \"field\": \".*\",\n \"value\": \".*\"\n },\n {\n \"type\": \"dns\",\n \"name\": \".*\",\n \"field\": \".*\",\n \"value\": \".*\"\n }\n ]\n },\n \"payload\": {\n \"enable\": \"false\",\n \"dir\": \"/tmp\"\n },\n \"tags\": {},\n \"protocol\": [],\n \"cribl\": {\n \"enable\": \"false\",\n \"transport\": {\n \"type\": \"edge\"\n },\n \"authtoken\": \"\"\n }\n }\n },\n \"environment\": {}\n }\n}\nstart.msg properties| Property | \nDescription | \n
|---|---|
authtoken (string) | \nToken used for authenticating to Cribl Edge or Stream. | \n
format required (string) | \nSpecifies the format for output of events and metrics from AppScope. See scope.yml.Possible values:
| \n
breaker (string) | \nSpecifies an Event Breaker for Cribl Edge or Stream to use. Value must be Cribl - Do Not Break Ruleset. | \n
info required (object) | \nThe principal container for start-message information, in the form of nested process, configuration, and environment objects.Details below. | \n
start.msg.info properties| Property | \nDescription | \n
|---|---|
process required (object) | \nDescribes the process associated with the scoped app. Details below. | \n
configuration required (object) | \nContainer for configurations. For now, describes current configuration only. Details below. | \n
environment required (object) | \nEnvironment variables present when the current configuration was loaded. Details below. | \n
start.msg.info.process properties| Property | \nDescription | \n
|---|---|
libscopever required (string) | \nVersion of the AppScope library that is currently loaded. Example: v1.0.0 | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
ppid required (integer) | \nThe process ID of the parent process of the scoped app. | \n
gid required (integer) | \nGroup ID of the user who created the process. Example: 0 | \n
groupname required (string) | \nGroupname of the user who created the process. Example: root | \n
uid required (integer) | \nUser ID of the user who created the process. Example: 0 | \n
username required (string) | \nUsername of the user who created the process. Example: root | \n
hostname required (string) | \nHostname for the host on which the scoped app was run. | \n
procname required (string) | \nThe name of the scoped app's process. | \n
cmd required (string) | \nThe command that was run to start the scoped app. Example: top | \n
id required (string) | \nAn ID that concatenates (possibly truncated) the scoped app's hostname, procname, and command, to facilitate correlation of similar processes when searching, graphing, or aggregating. | \n
cgroup required (string) | \nThe cgroup for the process. | \n
machine_id required (string) | \nA unique identifier for a machine. | \n
uuid required (string) | \nA unique identifier for a process. | \n
start.msg.info.configuration properties| Property | \nDescription | \n
|---|---|
current (object) | \nDescribes the current configuration. Details below. | \n
start.msg.info.environment properties| Property | \nDescription | \n
|---|
start.msg.info.configuration.current properties| Property | \nDescription | \n
|---|---|
metric (object) | \nSettings for metrics. See scope.yml.Details below. | \n
libscope (object) | \nSpecifies how to set up the AppScope library. See scope.yml.Details below. | \n
event (object) | \nSettings for events. See scope.yml.Details below. | \n
payload (object) | \nSettings for enabling and storing payloads. See scope.yml.Details below. | \n
tags (object) | \nUser-defined tags which become fields in generated events and metrics. See scope.yml.Details below. | \n
protocol (array) | \nList whose entries define protocols that AppScope should detect in network payloads, and how to handle matches. See scope.yml. | \n
cribl (object) | \nSettings for the cribl backend. See scope.yml.Details below. | \n
start.msg.info.configuration.current.metric properties| Property | \nDescription | \n
|---|---|
enable (string) | \nSpecifies whether a feature or some functionality is enabled or disabled overall. Possible values:
| \n
transport (object) | \nBackend connection for metrics or events. See scope.yml.Details below. | \n
format (object) | \nSettings for the format of metric data. See scope.yml.Details below. | \n
watch (array) | \nArray containing objects that enable different categories of metrics. See scope.yml. | \n
start.msg.info.configuration.current.libscope properties| Property | \nDescription | \n
|---|---|
log (object) | \nLogging settings for the AppScope library. See scope.yml.Details below. | \n
configevent (string) | \nWhen enabled, AppScope guarantees that a process start message is the first event sent over the current connection. Possible values:
| \n
summaryperiod (integer) | \nTime interval over which to perform aggregation. See scope.yml. | \n
commanddir (string) | \nThe directory AppScope polls for a scope.<pid> file, as explained in the Dynamic Configuration section of the Using the CLI page of the AppScope docs. | \n
snapshot (object) | \nSettings to specify content of the snapshot AppScope creates for crash analysis. Details below. | \n
start.msg.info.configuration.current.event properties| Property | \nDescription | \n
|---|---|
enable (string) | \nSpecifies whether a feature or some functionality is enabled or disabled overall. Possible values:
| \n
transport (object) | \nBackend connection for events. See scope.yml.Details below. | \n
format (object) | \nSettings for the format of event data. See scope.yml.Details below. | \n
watch (array) | \nArray containing objects that enable different categories of events. See scope.yml. | \n
start.msg.info.configuration.current.payload properties| Property | \nDescription | \n
|---|---|
enable (string) | \nSpecifies whether a feature or some functionality is enabled or disabled overall. Possible values:
| \n
dir (string) | \nSpecifies director where payload data should be written. Applies only when payloads are enabled and a backend other than cribl is used. See scope.yml. | \n
start.msg.info.configuration.current.tags properties| Property | \nDescription | \n
|---|
start.msg.info.configuration.current.cribl properties| Property | \nDescription | \n
|---|---|
enable (string) | \nSpecifies whether a feature or some functionality is enabled or disabled overall. Possible values:
| \n
transport (object) | \nBackend connection to Cribl Edge or Stream. See scope.yml.Details below. | \n
authtoken (string) | \nToken used for authenticating to Cribl Edge or Stream. | \n
start.msg.info.configuration.current.metric.transport properties| Property | \nDescription | \n
|---|---|
type (string) | \nSpecifies the transport mechanism on which to send and/or receive data. See scope.yml.Possible values:
| \n
host (string) | \nHostname for the host on which the scoped app was run. | \n
port (string) | \nConnection port. See scope.yml. | \n
path (string) | \nFile or UNIX domain socket path. See scope.yml.Example: /tmp/scope.log | \n
buffering (string) | \nFile buffering. See scope.yml.Possible values:
| \n
tls (object) | \nTLS connection settings. See scope.yml.Details below. | \n
start.msg.info.configuration.current.metric.format properties| Property | \nDescription | \n
|---|---|
type (string) | \nSpecifies the format of metric data. See scope.yml. Possible values:
| \n
statsdprefix (string) | \nSpecifies a prefix to prepend the metric name. See scope.yml. | \n
statsdmaxlen (integer) | \nSpecifies the maximum length for a string that expresses a StatsD metric. See scope.yml. | \n
verbosity (integer) | \nControls the tag cardinality and aggregation of a metric. See scope.yml. | \n
start.msg.info.configuration.current.libscope.log properties| Property | \nDescription | \n
|---|---|
level (string) | \nSpecifies log level. See scope.yml.Possible values:
| \n
transport (object) | \nBackend connection for AppScope library logging. See scope.yml.Details below. | \n
start.msg.info.configuration.current.libscope.snapshot properties| Property | \nDescription | \n
|---|---|
coredump (string) | \nWhen true, AppScope captures a core dump whenever the kernel sends the scoped app a fatal signal (i.e., illegal instruction, bus error, segmentation fault, or floating point exception). Possible values:
| \n
backtrace (string) | \nWhen true, AppScope captures a backtrace (a.k.a. stack trace) whenever the kernel sends the scoped app a fatal signal (i.e., illegal instruction, bus error, segmentation fault, or floating point exception). Possible values:
| \n
start.msg.info.configuration.current.event.transport properties| Property | \nDescription | \n
|---|---|
type (string) | \nSpecifies the transport mechanism on which to send and/or receive data. See scope.yml.Possible values:
| \n
host (string) | \nHostname for the host on which the scoped app was run. | \n
port (string) | \nConnection port. See scope.yml. | \n
path (string) | \nFile or UNIX domain socket path. See scope.yml.Example: /tmp/scope.log | \n
buffering (string) | \nFile buffering. See scope.yml.Possible values:
| \n
tls (object) | \nSpecifies whether to enable TLS for the metrics backend. See scope.yml.Details below. | \n
start.msg.info.configuration.current.event.format properties| Property | \nDescription | \n
|---|---|
type (string) | \nSpecifies the format of metric data. See scope.yml. Possible values:
| \n
maxeventpersec (integer) | \nSpecifies a rate limit for events. See scope.yml. | \n
enhancefs (string) | \nSpecifies whether to display full information about fs events.Possible values:
| \n
start.msg.info.configuration.current.cribl.transport properties| Property | \nDescription | \n
|---|---|
type (string) | \nSpecifies the transport mechanism on which to send and/or receive data. See scope.yml.Possible values:
| \n
host (string) | \nHostname for the host on which the scoped app was run. | \n
port (string) | \nConnection port. See scope.yml. | \n
path (string) | \nFile or UNIX domain socket path. See scope.yml.Example: /tmp/scope.log | \n
buffering (string) | \nFile buffering. See scope.yml.Possible values:
| \n
tls (object) | \nTLS settings for the Cribl backend. See scope.yml.Details below. | \n
start.msg.info.configuration.current.metric.transport.tls properties| Property | \nDescription | \n
|---|---|
enable (string) | \nSpecifies whether a feature or some functionality is enabled or disabled overall. Possible values:
| \n
validateserver (string) | \nSpecifies whether to validate the TLS server certificate. See scope.yml.Possible values:
| \n
cacertpath (string) | \nCA Certificate Path. See scope.yml. | \n
start.msg.info.configuration.current.libscope.log.transport properties| Property | \nDescription | \n
|---|---|
type (string) | \nSpecifies the transport mechanism on which to send and/or receive data. See scope.yml.Possible values:
| \n
host (string) | \nHostname for the host on which the scoped app was run. | \n
port (string) | \nConnection port. See scope.yml. | \n
path (string) | \nFile or UNIX domain socket path. See scope.yml.Example: /tmp/scope.log | \n
buffering (string) | \nFile buffering. See scope.yml.Possible values:
| \n
tls (object) | \nTLS settings for backend used by the AppScope library. See scope.yml.Details below. | \n
start.msg.info.configuration.current.event.transport.tls properties| Property | \nDescription | \n
|---|---|
enable (string) | \nSpecifies whether a feature or some functionality is enabled or disabled overall. Possible values:
| \n
validateserver (string) | \nSpecifies whether to validate the TLS server certificate. See scope.yml.Possible values:
| \n
cacertpath (string) | \nCA Certificate Path. See scope.yml. | \n
start.msg.info.configuration.current.cribl.transport.tls properties| Property | \nDescription | \n
|---|---|
enable (string) | \nSpecifies whether a feature or some functionality is enabled or disabled overall. Possible values:
| \n
validateserver (string) | \nSpecifies whether to validate the TLS server certificate. See scope.yml.Possible values:
| \n
cacertpath (string) | \nCA Certificate Path. See scope.yml. | \n
start.msg.info.configuration.current.libscope.log.transport.tls properties| Property | \nDescription | \n
|---|---|
enable (string) | \nSpecifies whether a feature or some functionality is enabled or disabled overall. Possible values:
| \n
validateserver (string) | \nSpecifies whether to validate the TLS server certificate. See scope.yml.Possible values:
| \n
cacertpath (string) | \nCA Certificate Path. See scope.yml. | \n
Structure of the dns.req metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"dns.req\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"lt-curl\",\n \"pid\": 31,\n \"host\": \"2a6bc132b07a\",\n \"unit\": \"request\",\n \"summary\": \"true\",\n \"_time\": 1643832467.795134\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"dns.req\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"lt-curl\",\n \"pid\": 2485,\n \"host\": \"2a6bc132b07a\",\n \"domain\": \"cribl.io\",\n \"duration\": 0,\n \"unit\": \"request\",\n \"_time\": 1643832569.764219\n }\n}\ndns.req properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
dns.req.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a Network DNS operation. Value must be dns.req. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
domain (string) | \nThe domain for which the scoped app made a DNS request. | \n
duration (number) | \nDuration in milliseconds. Example: 55 | \n
unit required (string) | \nIndicates that the metric's value is a number of a requests. Value must be request. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the fs.close metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.close\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 13687,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"operation\",\n \"summary\": \"true\",\n \"_time\": 1643826403.121424\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.close\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 9871,\n \"fd\": 3,\n \"host\": \"1f0ec6c8a7bc\",\n \"op\": \"close\",\n \"file\": \"/dev/shm/ltp_accept01_9870\",\n \"unit\": \"operation\",\n \"_time\": 1643826292.07658\n }\n}\nfs.close properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
fs.close.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a File Close operation. Value must be fs.close. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe close operation that was executed on the filesystem. Possible values:
| \n
file (string) | \nThe name of the file. | \n
unit required (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the fs.duration metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.duration\",\n \"_metric_type\": \"histogram\",\n \"_value\": 1,\n \"proc\": \"access01\",\n \"pid\": 13697,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"microsecond\",\n \"summary\": \"true\",\n \"_time\": 1643826404.006442\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.duration\",\n \"_metric_type\": \"histogram\",\n \"_value\": 16,\n \"proc\": \"accept01\",\n \"pid\": 9871,\n \"fd\": 3,\n \"host\": \"1f0ec6c8a7bc\",\n \"op\": \"fgets_unlocked\",\n \"file\": \"/etc/passwd\",\n \"numops\": 1,\n \"unit\": \"microsecond\",\n \"_time\": 1643826292.076675\n }\n}\nfs.duration properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
fs.duration.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a File Duration operation. Value must be fs.duration. | \n
_metric_type required (string) | \nIndicates that the metric from the scoped app is a histogram. Value must be histogram. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe function that was executed. | \n
file (string) | \nThe name of the file. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit required (string) | \nIndicates that the metric's value is in microseconds. Value must be microsecond. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the fs.error metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.error\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 13686,\n \"host\": \"1f0ec6c8a7bc\",\n \"class\": \"stat\",\n \"unit\": \"operation\",\n \"summary\": \"true\",\n \"_time\": 1643826403.123802\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.error\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept02\",\n \"pid\": 9872,\n \"host\": \"1f0ec6c8a7bc\",\n \"op\": \"readdir\",\n \"file\": \"/tmp/QxbCjC\",\n \"class\": \"read_write\",\n \"unit\": \"operation\",\n \"_time\": 1643826292.14466\n }\n}\nfs.error properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
fs.error.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a File Error operation. Value must be fs.error. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe function that was executed. | \n
file (string) | \nThe name of the file. | \n
class required (string) | \nSubcategory of filesystem error. Possible values:
| \n
unit required (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the fs.open metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.open\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 13687,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"operation\",\n \"summary\": \"true\",\n \"_time\": 1643826403.121411\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.open\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 9871,\n \"fd\": 3,\n \"host\": \"1f0ec6c8a7bc\",\n \"op\": \"open\",\n \"file\": \"/dev/shm/ltp_accept01_9870\",\n \"unit\": \"operation\",\n \"_time\": 1643826292.076503\n }\n}\nfs.open properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
fs.open.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a File open operation. Value must be fs.open. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe open operation that was executed on the filesystem. Possible values:
| \n
file (string) | \nThe name of the file. | \n
unit required (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the fs.read metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.read\",\n \"_metric_type\": \"counter\",\n \"_value\": 13312,\n \"proc\": \"access01\",\n \"pid\": 13697,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"byte\",\n \"summary\": \"true\",\n \"_time\": 1643826404.006381\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.read\",\n \"_metric_type\": \"counter\",\n \"_value\": 4096,\n \"proc\": \"accept01\",\n \"pid\": 9871,\n \"fd\": 3,\n \"host\": \"1f0ec6c8a7bc\",\n \"op\": \"fgets_unlocked\",\n \"file\": \"/etc/passwd\",\n \"numops\": 1,\n \"unit\": \"byte\",\n \"_time\": 1643826292.076709\n }\n}\nfs.read properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
fs.read.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a File Read operation. Value must be fs.read. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe read operation that was executed on the filesystem. Possible values:
| \n
file (string) | \nThe name of the file. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit required (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the fs.seek metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.seek\",\n \"_metric_type\": \"counter\",\n \"_value\": 3,\n \"proc\": \"sh\",\n \"pid\": 13810,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"operation\",\n \"summary\": \"true\",\n \"_time\": 1643826404.175738\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.seek\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"sh\",\n \"pid\": 9994,\n \"fd\": 3,\n \"host\": \"1f0ec6c8a7bc\",\n \"op\": \"lseek\",\n \"file\": \"./file_x\",\n \"unit\": \"operation\",\n \"_time\": 1643826293.407508\n }\n}\nfs.seek properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
fs.seek.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a File Seek operation. Value must be fs.seek. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe function that was executed. | \n
file (string) | \nThe name of the file. | \n
unit required (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the fs.stat metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.stat\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 13686,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"operation\",\n \"summary\": \"true\",\n \"_time\": 1643826403.123752\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.stat\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 9871,\n \"host\": \"1f0ec6c8a7bc\",\n \"op\": \"access\",\n \"file\": \"/dev/shm\",\n \"unit\": \"operation\",\n \"_time\": 1643826292.076446\n }\n}\nfs.stat properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
fs.stat.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a File Stat operation. Value must be fs.stat. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe function that was executed. | \n
file (string) | \nThe name of the file. | \n
unit required (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the fs.write metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.write\",\n \"_metric_type\": \"counter\",\n \"_value\": 10,\n \"proc\": \"access02\",\n \"pid\": 13806,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"byte\",\n \"summary\": \"true\",\n \"_time\": 1643826404.234963\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"fs.write\",\n \"_metric_type\": \"counter\",\n \"_value\": 10,\n \"proc\": \"access02\",\n \"pid\": 9991,\n \"fd\": 3,\n \"host\": \"1f0ec6c8a7bc\",\n \"op\": \"__write_libc\",\n \"file\": \"file_x\",\n \"numops\": 1,\n \"unit\": \"byte\",\n \"_time\": 1643826293.385378\n }\n}\nfs.write properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
fs.write.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a File Write operation. Value must be fs.write. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe write operation that was executed on the filesystem. Possible values:
| \n
file (string) | \nThe name of the file. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit required (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the http.duration.client metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"http.duration.client\",\n \"_metric_type\": \"timer\",\n \"_value\": 6,\n \"http_target\": \"/\",\n \"numops\": 1,\n \"proc\": \"lt-curl\",\n \"pid\": 788,\n \"host\": \"c067d78736db\",\n \"unit\": \"millisecond\",\n \"summary\": \"true\",\n \"_time\": 1643924553.681483\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"http.duration.client\",\n \"_metric_type\": \"timer\",\n \"_value\": 7,\n \"http_target\": \"/\",\n \"numops\": 1,\n \"proc\": \"lt-curl\",\n \"pid\": 30,\n \"host\": \"c067d78736db\",\n \"unit\": \"millisecond\",\n \"summary\": \"true\",\n \"_time\": 1643924472.648148\n }\n}\nhttp.duration.client properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
http.duration.client.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a counter that measures HTTP client duration. Value must be http.duration.client. | \n
_metric_type required (string) | \nIndicates that the metric is a timer. Value must be timer. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
http_target required (string) | \nIn a URL, the path or file after the FQDN. | \n
numops required (number) | \nCount of individual operations aggregated. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is in milliseconds. Value must be millisecond. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the http.duration.server metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"http.duration.server\",\n \"_metric_type\": \"timer\",\n \"_value\": 0,\n \"http_target\": \"/\",\n \"numops\": 1,\n \"proc\": \"httpd\",\n \"pid\": 2260,\n \"host\": \"c067d78736db\",\n \"unit\": \"millisecond\",\n \"summary\": \"true\",\n \"_time\": 1643924563.450939\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"http.duration.server\",\n \"_metric_type\": \"timer\",\n \"_value\": 1,\n \"http_target\": \"/\",\n \"numops\": 1,\n \"proc\": \"httpd\",\n \"pid\": 648,\n \"host\": \"c067d78736db\",\n \"unit\": \"millisecond\",\n \"summary\": \"true\",\n \"_time\": 1643924498.350866\n }\n}\nhttp.duration.server properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
http.duration.server.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a counter that measures HTTP server duration. Value must be http.duration.server. | \n
_metric_type required (string) | \nIndicates that the metric is a timer. Value must be timer. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
http_target required (string) | \nIn a URL, the path or file after the FQDN. | \n
numops required (number) | \nCount of individual operations aggregated. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is in milliseconds. Value must be millisecond. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the http.req metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"http.req\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"http_target\": \"/\",\n \"http_status_code\": 200,\n \"proc\": \"lt-curl\",\n \"pid\": 788,\n \"host\": \"c067d78736db\",\n \"unit\": \"request\",\n \"summary\": \"true\",\n \"_time\": 1643924553.681441\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"http.req\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"http_target\": \"/\",\n \"http_status_code\": 200,\n \"proc\": \"lt-curl\",\n \"pid\": 30,\n \"host\": \"c067d78736db\",\n \"unit\": \"request\",\n \"summary\": \"true\",\n \"_time\": 1643924472.64811\n }\n}\nhttp.req properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
http.req.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the metric Source aggregates HTTP requests and responses. Value must be http.req. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
http_target required (string) | \nIn a URL, the path or file after the FQDN. | \n
http_status_code required (integer) | \nSpecifies the status code of an HTTP response. Possible values:
| \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is a number of a requests. Value must be request. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the http.req.content_length metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"http.req.content_length\",\n \"_metric_type\": \"counter\",\n \"_value\": 38,\n \"http_target\": \"/echo/post/json\",\n \"numops\": 1,\n \"proc\": \"curl\",\n \"pid\": 525,\n \"host\": \"272cc69a120a\",\n \"unit\": \"byte\",\n \"summary\": \"true\",\n \"_time\": 1644230452.63037\n }\n}\nhttp.req.content_length properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
http.req.content_length.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a counter that measures HTTP request content length. Value must be http.req.content_length. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
http_target required (string) | \nIn a URL, the path or file after the FQDN. | \n
numops required (number) | \nCount of individual operations aggregated. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the http.resp.content_length metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"http.resp.content_length\",\n \"_metric_type\": \"counter\",\n \"_value\": 58896,\n \"http_target\": \"/\",\n \"numops\": 1,\n \"proc\": \"lt-curl\",\n \"pid\": 788,\n \"host\": \"c067d78736db\",\n \"unit\": \"byte\",\n \"summary\": \"true\",\n \"_time\": 1643924553.6815\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"http.resp.content_length\",\n \"_metric_type\": \"counter\",\n \"_value\": 58896,\n \"http_target\": \"/\",\n \"numops\": 1,\n \"proc\": \"lt-curl\",\n \"pid\": 30,\n \"host\": \"c067d78736db\",\n \"unit\": \"byte\",\n \"summary\": \"true\",\n \"_time\": 1643924472.648165\n }\n}\nhttp.resp.content_length properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
http.resp.content_length.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a counter that measures HTTP response content length. Value must be http.resp.content_length. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
http_target required (string) | \nIn a URL, the path or file after the FQDN. | \n
numops required (number) | \nCount of individual operations aggregated. | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.close metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.close\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 13687,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"connection\",\n \"summary\": \"true\",\n \"_time\": 1643826403.12145\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.close\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 9871,\n \"fd\": 5,\n \"host\": \"1f0ec6c8a7bc\",\n \"proto\": \"UDP\",\n \"port\": 0,\n \"unit\": \"connection\",\n \"_time\": 1643826292.077388\n }\n}\nnet.close properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.close.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a Network Close operation. Value must be net.close. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe function that was executed. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit required (string) | \nIndicates that the metric's value is a number of connections. Value must be connection. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.duration metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.duration\",\n \"_metric_type\": \"timer\",\n \"_value\": 1,\n \"proc\": \"sendfile06_64\",\n \"pid\": 15385,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"millisecond\",\n \"summary\": \"true\",\n \"_time\": 1643826428.960074\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.duration\",\n \"_metric_type\": \"timer\",\n \"_value\": 53,\n \"proc\": \"send02\",\n \"pid\": 11555,\n \"fd\": 3,\n \"host\": \"1f0ec6c8a7bc\",\n \"proto\": \"UDP\",\n \"port\": 0,\n \"numops\": 1,\n \"unit\": \"millisecond\",\n \"_time\": 1643826318.65727\n }\n}\nnet.duration properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.duration.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a counter that measures Network duration. Value must be net.duration. | \n
_metric_type required (string) | \nIndicates that the metric is a timer. Value must be timer. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit required (string) | \nIndicates that the metric's value is in milliseconds. Value must be millisecond. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.error metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.error\",\n \"_metric_type\": \"counter\",\n \"_value\": 6,\n \"proc\": \"accept01\",\n \"pid\": 5920,\n \"host\": \"7cb66c7f77dd\",\n \"op\": \"summary\",\n \"class\": \"connection\",\n \"unit\": \"operation\",\n \"_time\": 1643749774.573214\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.error\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"recv01\",\n \"pid\": 3593,\n \"host\": \"7cb66c7f77dd\",\n \"op\": \"recv\",\n \"class\": \"rx_tx\",\n \"unit\": \"operation\",\n \"_time\": 1643749590.518109\n }\n}\nnet.error properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.error.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a Network Error operation. Value must be net.error. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
op (string) | \nThe function that was executed. | \n
class required (string) | \nSubcategory of network error. Possible values:
| \n
unit required (string) | \nIndicates that the metric's value is a number of operations. Value must be operation. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.open metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.open\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 13687,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"connection\",\n \"summary\": \"true\",\n \"_time\": 1643826403.121437\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.open\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"lt-curl\",\n \"pid\": 2485,\n \"fd\": 7,\n \"host\": \"2a6bc132b07a\",\n \"proto\": \"UDP\",\n \"port\": 0,\n \"unit\": \"connection\",\n \"_time\": 1643832569.764144\n }\n}\nnet.open properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.open.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a Network Open operation. Value must be net.open. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit required (string) | \nIndicates that the metric's value is a number of connections. Value must be connection. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.other metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.other\",\n \"_metric_type\": \"gauge\",\n \"_value\": 1,\n \"proc\": \"server_seqpacket\",\n \"pid\": 234979,\n \"host\": \"test_user\",\n \"unit\": \"connection\",\n \"summary\": \"true\",\n \"_time\": 1643887036.00144\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.other\",\n \"_metric_type\": \"gauge\",\n \"_value\": 1,\n \"proc\": \"server_seqpacket\",\n \"pid\": 235293,\n \"fd\": 4,\n \"host\": \"test_user\",\n \"proto\": \"SEQPACKET\",\n \"port\": 0,\n \"unit\": \"connection\",\n \"_time\": 1643887122.646226\n }\n}\nnet.other properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.other.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a Network operation of an other-than-standard kind. Value must be net.other. | \n
_metric_type required (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit required (string) | \nIndicates that the metric's value is a number of connections. Value must be connection. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.port metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.port\",\n \"_metric_type\": \"gauge\",\n \"_value\": 2,\n \"proc\": \"accept02\",\n \"pid\": 13689,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"instance\",\n \"summary\": \"true\",\n \"_time\": 1643826403.184484\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.port\",\n \"_metric_type\": \"gauge\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 9871,\n \"fd\": 4,\n \"host\": \"1f0ec6c8a7bc\",\n \"proto\": \"TCP\",\n \"port\": 0,\n \"unit\": \"instance\",\n \"_time\": 1643826292.076967\n }\n}\nnet.port properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.port.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a gauge that identifies open ports. Value must be net.port. | \n
_metric_type required (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit required (string) | \nIndicates that the metric's value is a number of instances. Value must be instance. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.rx metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.rx\",\n \"_metric_type\": \"counter\",\n \"_value\": 99000,\n \"proc\": \"send02\",\n \"pid\": 15371,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"byte\",\n \"class\": \"inet_udp\",\n \"summary\": \"true\",\n \"_time\": 1643826428.564141\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.rx\",\n \"_metric_type\": \"counter\",\n \"_value\": 6,\n \"proc\": \"recvfrom01\",\n \"pid\": 11544,\n \"fd\": 4,\n \"host\": \"1f0ec6c8a7bc\",\n \"domain\": \"AF_INET\",\n \"proto\": \"TCP\",\n \"localip\": \"127.0.0.1\",\n \"localp\": 37432,\n \"remoteip\": \"0.0.0.0\",\n \"remotep\": 40765,\n \"data\": \"clear\",\n \"numops\": 1,\n \"unit\": \"byte\",\n \"_time\": 1643826317.098972\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.rx\",\n \"_metric_type\": \"counter\",\n \"_value\": 16,\n \"proc\": \"send02\",\n \"pid\": 11555,\n \"fd\": 3,\n \"host\": \"1f0ec6c8a7bc\",\n \"domain\": \"AF_INET\",\n \"proto\": \"UDP\",\n \"localip\": \"127.0.0.1\",\n \"localp\": 0,\n \"remoteip\": \" \",\n \"remotep\": 0,\n \"data\": \"clear\",\n \"numops\": 1,\n \"unit\": \"byte\",\n \"_time\": 1643826318.241899\n }\n}\nnet.rx properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.rx.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a Network receive operation. Value must be net.rx. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
domain (string) | \nThe domain for which the scoped app made a DNS request. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
localn (number) | \nInode number for the local end of a UNIX domain socket. | \n
localip (string) | \nThe IP address portion of the local end of a network connection. Example: 127.0.0.1 | \n
localp (number) | \nThe port portion of the local end of a network connection. Example: 9109 | \n
remoten (number) | \nInode number for the remote end of a UNIX domain socket. | \n
remoteip (string) | \nIP address for the remote end of a network socket. Example: 192.158.1.38 | \n
remotep (number) | \nPort for the remote end of a network socket. Example: 9108 | \n
data (string) | \nThe data that the scoped app emitted as output. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit required (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
class (string) | \nSubcategory of send and receive operations. Possible values:
| \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.tcp metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.tcp\",\n \"_metric_type\": \"gauge\",\n \"_value\": 1,\n \"proc\": \"accept02\",\n \"pid\": 13689,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"connection\",\n \"summary\": \"true\",\n \"_time\": 1643826403.184497\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.tcp\",\n \"_metric_type\": \"gauge\",\n \"_value\": 0,\n \"proc\": \"accept01\",\n \"pid\": 9871,\n \"fd\": 4,\n \"host\": \"1f0ec6c8a7bc\",\n \"proto\": \"TCP\",\n \"port\": 0,\n \"unit\": \"connection\",\n \"_time\": 1643826292.07731\n }\n}\nnet.tcp properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.tcp.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a gauge that shows the current count of open TCP ports. Value must be net.tcp. | \n
_metric_type required (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Value must be TCP. | \n
port (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit required (string) | \nIndicates that the metric's value is a number of connections. Value must be connection. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.tx metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.tx\",\n \"_metric_type\": \"counter\",\n \"_value\": 3,\n \"proc\": \"recvmsg01\",\n \"pid\": 15364,\n \"host\": \"1f0ec6c8a7bc\",\n \"unit\": \"byte\",\n \"class\": \"unix_tcp\",\n \"summary\": \"true\",\n \"_time\": 1643826427.279136\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.tx\",\n \"_metric_type\": \"counter\",\n \"_value\": 16,\n \"proc\": \"send02\",\n \"pid\": 11555,\n \"fd\": 4,\n \"host\": \"1f0ec6c8a7bc\",\n \"domain\": \"AF_INET\",\n \"proto\": \"UDP\",\n \"localip\": \"0.0.0.0\",\n \"localp\": 0,\n \"remoteip\": \"127.0.0.1\",\n \"remotep\": 38725,\n \"data\": \"clear\",\n \"numops\": 1,\n \"unit\": \"byte\",\n \"_time\": 1643826318.241855\n }\n}\n{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.tx\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"recvmsg01\",\n \"pid\": 11548,\n \"fd\": 3,\n \"host\": \"1f0ec6c8a7bc\",\n \"domain\": \"UNIX\",\n \"proto\": \"TCP\",\n \"localn\": 48335,\n \"remoten\": 46396,\n \"data\": \"clear\",\n \"numops\": 1,\n \"unit\": \"byte\",\n \"_time\": 1643826317.162209\n }\n}\nnet.tx properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.tx.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a Network transmit operation. Value must be net.tx. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
domain (string) | \nThe domain for which the scoped app made a DNS request. | \n
proto (string) | \nThe transmission protocol that the scoped app used to send data. Possible values:
| \n
localn (number) | \nInode number for the local end of a UNIX domain socket. | \n
localip (string) | \nThe IP address portion of the local end of a network connection. Example: 127.0.0.1 | \n
localp (number) | \nThe port portion of the local end of a network connection. Example: 9109 | \n
remoten (number) | \nInode number for the remote end of a UNIX domain socket. | \n
remoteip (string) | \nIP address for the remote end of a network socket. Example: 192.158.1.38 | \n
remotep (number) | \nPort for the remote end of a network socket. Example: 9108 | \n
data (string) | \nThe data that the scoped app emitted as output. | \n
numops (number) | \nCount of individual operations aggregated. | \n
unit required (string) | \nIndicates that the metric's value is in bytes. Value must be byte. | \n
class (string) | \nSubcategory of send and receive operations. Possible values:
| \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the net.udp metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"net.udp\",\n \"_metric_type\": \"gauge\",\n \"_value\": 0,\n \"proc\": \"accept01\",\n \"pid\": 9871,\n \"fd\": 5,\n \"host\": \"1f0ec6c8a7bc\",\n \"proto\": \"UDP\",\n \"port\": 0,\n \"unit\": \"connection\",\n \"_time\": 1643826292.077372\n }\n}\nnet.udp properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
net.udp.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a gauge that shows the current count of open UDP ports. Value must be net.udp. | \n
_metric_type required (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
fd required (integer) | \nThe file descriptor for an operation. Example: 4 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
proto required (string) | \nThe transmission protocol that the scoped app used to send data. Value must be UDP. | \n
port required (number) | \nNetwork port opened before a connection was initiated, or closed after the connection closed. | \n
unit required (string) | \nIndicates that the metric's value is a number of connections. Value must be connection. | \n
summary (string) | \nWhen true, indicates that the metric value is an aggregation. Value must be true. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the proc.child metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"proc.child\",\n \"_metric_type\": \"gauge\",\n \"_value\": 0,\n \"proc\": \"accept01\",\n \"pid\": 1946,\n \"host\": \"7cb66c7f77dd\",\n \"unit\": \"process\",\n \"_time\": 1643749566.030543\n }\n}\nproc.child properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
proc.child.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a gauge of child processes spawned. Value must be proc.child. | \n
_metric_type required (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is a number of processes. Value must be process. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the proc.cpu metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"proc.cpu\",\n \"_metric_type\": \"counter\",\n \"_value\": 2107,\n \"proc\": \"accept01\",\n \"pid\": 1946,\n \"host\": \"7cb66c7f77dd\",\n \"unit\": \"microsecond\",\n \"_time\": 1643749566.030295\n }\n}\nproc.cpu properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
proc.cpu.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a counter of microseconds of the process's CPU were scheduled. Value must be proc.cpu. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is in microseconds. Value must be microsecond. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the proc.cpu_perc metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"proc.cpu_perc\",\n \"_metric_type\": \"gauge\",\n \"_value\": 0.02107,\n \"proc\": \"accept01\",\n \"pid\": 1946,\n \"host\": \"7cb66c7f77dd\",\n \"unit\": \"percent\",\n \"_time\": 1643749566.030327\n }\n}\nproc.cpu.perc properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
proc.cpu.perc.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a gauge that measures percentage of CPU used by the process. Value must be proc.cpu_perc. | \n
_metric_type required (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is a percentage. Value must be percent. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the proc.fd metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"proc.fd\",\n \"_metric_type\": \"gauge\",\n \"_value\": 5,\n \"proc\": \"accept01\",\n \"pid\": 1946,\n \"host\": \"7cb66c7f77dd\",\n \"unit\": \"file\",\n \"_time\": 1643749566.030497\n }\n}\nproc.fd properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
proc.fd.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a gauge that reports how many file descriptors the process has opened. Value must be proc.fd. | \n
_metric_type required (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is a number of files. Value must be file. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the proc.mem metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"proc.mem\",\n \"_metric_type\": \"gauge\",\n \"_value\": 31284,\n \"proc\": \"accept01\",\n \"pid\": 1946,\n \"host\": \"7cb66c7f77dd\",\n \"unit\": \"kibibyte\",\n \"_time\": 1643749566.030388\n }\n}\nproc.mem properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
proc.mem.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a gauge that reports process memory consumption. Value must be proc.mem. | \n
_metric_type required (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is in kibibytes. Value must be kibibyte. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the proc.start metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"proc.start\",\n \"_metric_type\": \"counter\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 1945,\n \"gid\": 0,\n \"groupname\": \"root\",\n \"uid\": 0,\n \"username\": \"root\",\n \"host\": \"7cb66c7f77dd\",\n \"args\": \"/opt/test/ltp/testcases/kernel/syscalls/accept/accept01\",\n \"unit\": \"process\",\n \"_time\": 1643749566.026885\n }\n}\nproc.start properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
proc.start.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a counter which can only be 1, meaning that the process has started. Value must be proc.start. | \n
_metric_type required (string) | \nIndicates that the metric is a counter. Value must be counter. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
gid required (integer) | \nGroup ID of the user who created the process. Example: 0 | \n
groupname required (string) | \nGroupname of the user who created the process. Example: root | \n
uid required (integer) | \nUser ID of the user who created the process. Example: 0 | \n
username required (string) | \nUsername of the user who created the process. Example: root | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
args required (string) | \nThe arguments with which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is a number of processes. Value must be process. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n
Structure of the proc.thread metric
{\n \"type\": \"metric\",\n \"body\": {\n \"_metric\": \"proc.thread\",\n \"_metric_type\": \"gauge\",\n \"_value\": 1,\n \"proc\": \"accept01\",\n \"pid\": 1946,\n \"host\": \"7cb66c7f77dd\",\n \"unit\": \"thread\",\n \"_time\": 1643749566.030435\n }\n}\nproc.thread properties| Property | \nDescription | \n
|---|---|
type required (string) | \nDistinguishes metrics from events. Value must be metric. | \n
body required (object) | \nbody Details below. | \n
proc.thread.body properties| Property | \nDescription | \n
|---|---|
_metric required (string) | \nIndicates that the Source is a gauge that reports how many threads are running in the process. Value must be proc.thread. | \n
_metric_type required (string) | \nIndicates that the metric is a gauge. Value must be gauge. | \n
_value required (number) | \nThe value reported by the event or metric. Example: 1 | \n
proc required (string) | \nThe name of the scoped app's process. | \n
pid required (integer) | \nThe process ID of the scoped app. Example: 1000 | \n
host required (string) | \nHostname for the host on which the scoped app was run. | \n
unit required (string) | \nIndicates that the metric's value is a number of threads. Value must be thread. | \n
_time required (number) | \nThe moment in time when AppScope reported the event or metric. In UNIX time with integer part in seconds and fractional part in microseconds. Example: 1643662126.91777 | \n