internal_options.conf: analysisd

Options for the analysis daemon (ossec-analysisd).

Location

All options are set in /var/ossec/etc/internal_options.conf or overridden in /var/ossec/etc/local_internal_options.conf.

Options

  • analysisd.default_timeframe

    Analysisd default rule timeframe

    Default: 360

    Allowed: Any integer

  • analysisd.stats_maxdiff

    Default: 25000

    Allowed: Any integer

  • analysisd.stats_mindiff

    Default: 250

    Allowed: Any integer

  • analysisd.stats_percent_diff

    Default: 30

    Allowed: Any integer

  • analysisd.fts_list_size

    Default: 32

    Allowed: Any integer

  • analysisd.fts_min_size_for_str

    Default: 14

    Allowed: Any integer

  • analysisd.log_fw

    Default: 1

    Allowed: Any integer

  • analysisd.debug

    Default: 0

    Allowed: Any integer

  • analysisd.decoder_order_size

    Added in version 4.1.0.

    Maximum number of fields in a decoder <order> list and maximum number of capture groups in a decoder <regex> or <pcre2> pattern.

    Default: 256

    Allowed: 8 to 1024

    If a decoder exceeds this limit, ossec-analysisd logs an error such as Order has too many fields or Regex has too many groups. Increase this value in /var/ossec/etc/local_internal_options.conf (not ossec.conf) and restart OSSEC.

    See also Decoders Syntax (decoder.order).

  • analysisd.event_threads

    Number of general decode worker threads. 0 means auto: min(online CPUs, 32).

    Default: 0

    Allowed: 0 to 32

  • analysisd.rule_matching_threads

    Number of rule-matching worker threads. Each thread has a private EventList shard and a dedicated decode-output queue. Events are routed by hashing location/hostname (analysisd_shard_id). 0 means auto: min(online CPUs, 32).

    Default: 0

    Allowed: 0 to 32

  • analysisd.syscheck_threads

    Number of syscheck decode worker threads. 0 means auto: min(online CPUs, 32).

    Default: 0

    Allowed: 0 to 32

  • analysisd.rootcheck_threads

    Number of rootcheck decode worker threads. 0 means auto: min(online CPUs, 32).

    Default: 0

    Allowed: 0 to 32

  • analysisd.hostinfo_threads

    Number of hostinfo decode worker threads. 0 means auto: min(online CPUs, 32).

    Default: 0

    Allowed: 0 to 32

  • analysisd.input_demux_threads

    Workers that demux raw messages from the Unix MQ receive path onto the per-type decode queues after the single receiver thread.

    Default: 2

    Allowed: 1 to 8

  • analysisd.sid_prev_matched_max

    Maximum retained events per if_matched_sid correlation list.

    Default: 128

    Allowed: Any positive integer (implementation-defined upper bound)

  • analysisd.raw_input_queue_size

    Front-door ring buffer between the Unix MQ receiver and demux workers.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.decode_event_queue_size

    Ring buffer size (minus one slot) for raw messages awaiting general decode.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.decode_syscheck_queue_size

    Ring buffer size for raw syscheck messages awaiting decode.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.decode_rootcheck_queue_size

    Ring buffer size for raw rootcheck messages awaiting decode.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.decode_hostinfo_queue_size

    Ring buffer size for raw hostinfo messages awaiting decode.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.decode_output_queue_size

    Ring buffer size for each rule-matching shard queue (decoded events).

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.alerts_queue_size

    Ring buffer size for alert writer thread backlog.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.statistical_queue_size

    Ring buffer size for the statistical / hourly alert writer backlog.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.raw_input_push_wait_ms

  • analysisd.demux_push_wait_ms

  • analysisd.shard_push_wait_ms

  • analysisd.alerts_push_wait_ms

    Milliseconds to wait when a mid-pipe push would block before dropping. 0 means immediate push/drop (no soak). Raise under bursty load together with queue sizes; lower EPS if drops persist.

    Defaults: 25 / 50 / 75 / 100

    Allowed: 0 to 5000

  • analysisd.archives_queue_size

    Ring buffer size for archive writer thread backlog. When full, archive copies are dropped (non-blocking) so rule matching is not stalled. logall is best-effort under backlog; see archives_dropped in the analysisd .state file.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.firewall_queue_size

    Ring buffer size for firewall writer thread backlog.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.fts_queue_size

    Ring buffer size for the async FTS (first-time-seen) disk writer. Match threads update in-memory FTS state under a short lock, then enqueue a line for the writer thread. When the queue is full, the match thread waits briefly then falls back to a synchronous write so entries are not lost.

    Default: 16384

    Allowed: 128 to 2000000

  • analysisd.state_interval

    Seconds between updates of the pipeline metrics state file (OS_PIDFILE/ossec-analysisd.state). 0 disables the state file. Each write includes queue depth/usage, drop counts, and events_processed_per_second (EPDS) for the prior interval.

    Default: 5

    Allowed: 0 to 86400

  • analysisd.geoip_jsonout

    Include GeoIP fields in JSON alert output when GeoIP databases are configured.

    Default: 0

    Allowed: 0 or 1