Configuration
The Sicura Agent Configuration File¶
Once your copy of Sicura Agent has been installed certain options can be set inside the sicura-agent.yaml file.
Note: This file is installed with the Agent and is preserved on upgrade — your settings are not overwritten when a new Agent version is installed.
The config file can be found here:
Linux: /etc/sicura/sicura-agent.yaml
Windows: C:\ProgramData\Sicura\Agent\sicura-agent.yaml
The Sicura Agent config file has three sections. Most options ship commented out (disabled) — to enable one, remove the # and set a value. A few options (log-level, collector-https, collector-port) ship already enabled with their default values.
General¶
Options in this section control the Agent's functionality system-wide.
log-level¶
By selecting log-level you will be able to control what information is output by the Agent to stdout and stderr. The levels can be lowered or raised seven values for troubleshooting: trace, debug, info, warn, error, fatal, and panic. The default is info.
Note: For most troubleshooting, debug is the most verbose useful level. The only output added by trace is the raw traffic on the collector connection.
log-to-file¶
This true/false option allows you to choose if you want output from the scanner to go to a file in addition to the terminal's stdout/stderr. The default destination for this file is:
- Linux —
/var/log/sicura/sicura-agent.log - Windows —
C:\ProgramData\Sicura\Agent\state\Logs\sicura-agent.log
log-dest¶
This is a custom-defined path where the log file will be saved. This will allow you to override the default log location.
collector-request-interval¶
The Agent keeps an open connection to its collector (see the Collector section below) and reconnects whenever that connection closes. collector-request-interval sets the wait between reconnection attempts, in seconds. The value is also sent to the Console, which may use it as the grace period before a node whose connection has dropped is marked disconnected (newer Console versions use a fixed three-minute window instead). The default is 2.
ignore-platform-mismatch¶
In some cases when doing CIS scans, a result-set may come back with all 'Not Applicable'. If this is the case, this option can be set true to attempt a CPE agnostic scan.
Collector¶
The collector is the Sicura Console endpoint the Agent keeps an open connection to — the Console pushes scan and enforcement jobs down that connection, and the Agent sends its reports back on it. The options in this section define how the Agent connects to it. For the Console-side collector settings, see Collector.
collector-https¶
Whether to use HTTPS when connecting to the collector. The config file shipped with the Agent enables this (collector-https: true). If the option is removed or commented out, the Agent falls back to HTTP.
collector¶
The hostname that connections should be made to. Overrides the default of the sicura-console-collector well known DNS entry.
collector-port¶
The port on which the Sicura Console is running and accepting connections. Default is the standard HTTP port (80).
Reports¶
Any output from the Agent is considered a "Report". By default, reports are sent to the Sicura Console collector for further evaluation and displayed in the Console UI. If desired, they can be kept on the local system.
save-reports¶
This true/false setting allows you to save the reports for each job. If true, reports save to STATE_DIRECTORY/reports by default.
report-path¶
Allows you to override the default path for reports.