Skip to content

Configuration

Jump to bottom
sat edited this page Jul 15, 2026 · 1 revision

Configuration

logdag is configured through a single INI-style configuration file (conventionally named logdag.conf). This page explains the configuration model — how the file is loaded, how it relates to the amulog configuration, and what the key sections do. For the complete, exhaustive per-option reference, see Configuration Options.

How logdag loads its configuration

logdag.arguments.open_logdag_config is the single entry point for loading a config. It uses amulog.config.open_config under the hood, which implements a two-layer merge:

  1. Default layer — logdag/data/config.conf.default (distributed with the package). Every known option is present with a sensible default.
  2. User layer — the file you pass on the command line (logdag <conf> <command> or via the LOGDAG_CONFIG environment variable). Only the options you set override the defaults; anything you omit inherits the default.

You never need to replicate the full default file. A minimal logdag.conf only needs the options that differ from the defaults for your deployment.

Environment variable override

Setting LOGDAG_CONFIG=/path/to/logdag.conf lets you omit the config argument on every invocation. The CLI path argument, when supplied, always takes precedence.

Relationship with the amulog configuration

logdag's configuration file does not contain amulog settings. Instead, the [database_amulog] section holds a pointer:

[database_amulog]
source_conf = amulog.conf   ; path to the separate amulog config file

When logdag needs to access the log-event data, it opens this second config file via logdag.arguments.open_amulog_config. All amulog settings (DB backend, log template files, host-group definitions, etc.) live in that separate file. The two configs are kept independent to let you reuse the same amulog database with multiple logdag experiments.

Viewing the effective configuration

Two subcommands help you inspect what logdag sees:

logdag <conf> show-deafult-config   # the raw defaults (no user conf needed)
logdag <conf> show-full-config      # merged result for your conf file

Note: show-deafult-config is the actual registered subcommand name (typo in registration is preserved for backward compatibility).

Key sections at a glance

The default file defines twelve sections. They fall into four functional groups:

1. General and feature database ([general], [database_*])

[general] controls the feature-DB pipeline — the first phase of processing where raw log events are converted into binned time-series features:

Concern Options
Enable / disable the feature DB use_evdb
Feature DB backend selection evdb (sql / influx / influx3)
Log and SNMP source types log_source (amulog), snmp_source (rrd)
Whole-term and time window for evdb build evdb_whole_term, evdb_unit_term, evdb_unit_diff
Bin size and smoothing evdb_binsize, evdb_convolve_radius
Host alias file host_alias_filename
System log path logging

Four [database_*] sections configure the corresponding backends:

  • [database_amulog] — pointer to the amulog config (source_conf), the event-grouping key (event_gid: ltgid or ltid), and host stratification (host_tier).
  • [database_rrd] — RRD fetch parameters for SNMP data.
  • [database_influx] — InfluxDB v1 connection settings (also works against InfluxDB v2 via its v1 compatibility API).
  • [database_influx3] — InfluxDB 3 Core connection settings (newer backend, no extra package required beyond stdlib). See Data Sources.
  • [database_sql] — SQLite3 or MySQL settings for the default SQL evdb backend.

2. Event filters ([filter])

Before features enter the causal-inference step, optional filters are applied. [filter] controls which filters run and their parameters:

Concern Options
Active filter pipeline rules (comma-separated list)
Minimum event frequency guard pre_count, pre_term
Fourier (periodicity) filter fourier_* options
Linear distribution filter linear_* options
Correlation-based filter corr_* options

Available rule names are sizetest, filter_periodic, remove_periodic, remove_corr, remove_linear. The default pipeline is sizetest, filter_periodic, remove_linear.

3. DAG estimation ([dag], [prior_knowledge], [lingam])

[dag] is the central section for the causal-inference phase:

Concern Options
Analysis whole-term whole_term
Data sources (log / SNMP) source
Areas (host groups) area, area_def
Job window size and stride unit_term, unit_diff
Conditional-independence binning ci_bin_method, ci_bin_size, ci_bin_diff
CI test function ci_func
Causal algorithm cause_algorithm
PC skeleton algorithm and tuning skeleton_method, skeleton_depth, skeleton_threshold
Synchronized-event merging merge_syncevent, merge_syncevent_rules
Output format and directory output_dir, output_dag_format

cause_algorithm selects the causal-discovery method. Supported values are pc, lingam, pc-corr, and lingam-corr. See Causal Discovery Methods for details.

[prior_knowledge] lets you inject structural constraints (network topology) into the PC algorithm. [lingam] tunes the LiNGAM algorithm (ICA variant and convergence).

4. Evaluation ([eval])

[eval] is a short section used by the logdag.eval sub-tool, which compares DAG outputs against labelled ground truth:

[eval]
path = eval_data   ; directory for evaluation data files

Host stratification

The [database_amulog] option host_tier enables host stratification: instead of treating each individual host as a separate node, events are aggregated by a named host-group tier defined in the amulog configuration. Set it to the tier name you defined in the amulog [manager] host_group_filename file. Leave it empty (the default) for the original per-host behaviour.

Typical minimal configuration

A minimal logdag.conf for a SQLite-backed local experiment:

[general]
evdb_whole_term = 2024-01-01 00:00:00, 2024-02-01 00:00:00
evdb = sql

[database_amulog]
source_conf = /path/to/amulog.conf

[database_sql]
sqlite3_filename = /data/logdag.db

[dag]
whole_term = 2024-01-01 00:00:00, 2024-02-01 00:00:00
area = all
unit_term = 30h
unit_diff = 24h
output_dir = /data/pc_output

Everything else inherits from the built-in defaults.

See also

Clone this wiki locally