Host, in this context, means a standalone Linux host or Virtual Machine.
This topic walks you through a setup procedure, and then through the two basic AppView techniques:
We assume that you have an Edge Leader running in Cribl.Cloud, and that you want to add a new Edge Node to its Fleet, and to appview processes running on the new Edge Node.
You can easily modify these instructions to add more than one Edge Node and then use AppView by Rules to appview processes on the entire Fleet.
In Cribl.Cloud:
default_fleet
is fine.cribl
to root
.Click Copy script and dismiss the modal.
On the Linux host we want to observe with Edge:
Edit the script so that it runs as root, by adding sudo
to the bash command at the end.
curl 'https://...%2Fcribl' | bash -
... should be edited as follows:curl 'https://... %2Fcribl' | sudo bash -
Return to Cribl.Cloud UI to verify that the new Node is present:
At this point, Edge is installed on a Linux container in its default location (/opt/cribl
), is running, and is connected to the Edge Leader.
Still in Edge’s List View tab:
On the Linux host:
top
. Back in Edge:
Within seconds, top
should appear in the process list. (If you don’t see it, try filtering by command.) At this point top
is running but is not yet instrumented by AppView.
top
command's row to open the Process: top drawer.In the AppView tab, select the AppView Configuration we want to use for this process.
A sensible AppView configuration ...
. Leave the default Source as in_appview
.
777
.Click Start monitoring.
Now you’ll want to confirm that Edge is receiving AppView data for the viewed top
process.
On the Edge Leader, navigate to More > Sources and select AppView to open the Source page.
In the row where ID
is in_appview
:
$CRIBL_HOME/state/appview.sock
. On the Linux host:
top
. On the Edge Leader:
ID
is in_appview
.In the AppView Rules tab, under Rules, click Add Rule and complete the Rule as follows:
top
A sensible AppView configuration ...
. Next:
Wait for the changes to be deployed to the Edge Node – probably around 30 seconds.
Back on the Linux host:
top
process.You should now see events flowing from two top
processes – they’ll have different PIDs.
Return to Edge’s List View tab – the AppView column should indicate that both top
processes are being viewed.
This gets to what’s so powerful about Rules: You can start processes after setting things up, and they get viewed.
Optionally, you can try the other two configurations and see how the viewed data changes. For the config that has payloads enabled, curl
and wget
are good choices.
If you want to do more, consider creating Routes and Pipelines in Cribl Edge, to send AppView data to your favorite Destination(s).