Configuration Options

Configuration Options

Complete reference for every option in logdag/data/config.conf.default, organized by section. Defaults shown are the exact values produced by logdag show-deafult-config (verified against version 0.3.1).

For the narrative on how the config file is loaded and how sections relate to the pipeline, see Configuration. For backend-specific setup detail, see Data Sources.

---

[general]

Controls the feature-DB build pipeline (phase 1) and overall runtime settings.

Option	Default	Description
use_evdb	true	Enable the feature database (evdb). Set to false to bypass evdb and read from amulog directly on every run.
dump_org	true	Store the pre-filter (raw) time-series alongside the filtered features in the evdb (log_org / log_feature measures). The --org CLI flag also forces this on for a single run.
evdb_whole_term	2112-09-01 00:00:00, 2112-10-01 00:00:00	Fetch term for building the evdb. Override with your actual data range. Format: YYYY-MM-DD HH:MM:SS, YYYY-MM-DD HH:MM:SS.
evdb_unit_term	24h	Length of each unit window when building the evdb.
evdb_unit_diff	24h	Stride between successive evdb unit windows.
evdb_binsize	1m	Bin size for the evdb time-series (1-minute bins by default).
evdb_convolve_radius	2	Smoothing convolution radius applied after binning. Window size is 2 * radius + 1.
evdb_args_fn	evdb_args	Base filename for the evdb argument list file.
logging	auto.log	Path for the system process log (logdag's own log output, not the input dataset). Leave empty to write to stderr.
log_source	amulog	Log event source type. Available: amulog. (RRD is used for SNMP only.)
snmp_source	rrd	SNMP metric source type. Available: rrd.
evdb	sql	Feature-DB backend. Available: sql, influx, influx3. Selects which [database_*] section is used.
host_alias_filename	(empty)	Path to an amulog host alias file. Leave empty to use raw hostnames.

---

[database_amulog]

Connection and behaviour settings for the amulog log-event source.

Option	Default	Description
source_conf	amulog.conf	Path to the amulog configuration file. logdag opens a separate amulog config; all amulog DB/template settings live there.
event_gid	ltgid	Grouping key for log-template events. ltgid = template-group ID (coarser, groups semantically similar templates); ltid = individual template ID (finer).
host_tier	(empty)	Host stratification tier (amulog host_group). Empty = no aggregation — use the original per-host events (legacy behaviour). A non-empty value must match a tier defined in the amulog host-group file ([manager] host_group_filename in the amulog config); events are then aggregated by host-group ID at that tier.
use_anonymize_mapping	false	Apply an anonymization mapping to host names.
given_amulog_database	anonymized	Interpretation of the amulog database specified by source_conf. anonymized = the DB is already anonymized; original = the DB uses original (non-anonymized) host names (differs from logdag input).

---

[database_rrd]

Settings for the RRD (SNMP) data source. Used when general.snmp_source = rrd.

Option	Default	Description
rows	1	Number of RRD data rows to fetch per step.
cf	MAX	RRD consolidation function (MAX, AVERAGE, etc.).
correct_roundup	true	Correct for RRD's round-up timestamping behaviour.
binsize	60	Bin size in seconds used when correct_roundup is active.

---

[database_influx]

InfluxDB v1 connection settings. Used when general.evdb = influx.

This backend also works against an InfluxDB v2 server via its v1 compatibility API. On the v2 side, create a DBRP mapping and a v1 auth token; then set host/port and username/password here (a separate v2 backend is not needed; verified against v2.7 for add / get_count / get_df including func="sum").

Option	Default	Description
host	localhost	InfluxDB server hostname.
port	8086	InfluxDB server port.
username	root	InfluxDB username.
passwd	root	InfluxDB password.
log_dbname	log	Database name for log-event time-series.
snmp_dbname	snmp	Database name for SNMP metric time-series.
snmp_source_dbname	snmp	Database name for raw SNMP source data.
batch_size	1000	Number of points per write batch.
protocol	line	Write protocol (line for Line Protocol).

---

[database_influx3]

InfluxDB 3 Core backend settings. Used when general.evdb = influx3.

This backend uses the v3 HTTP API (SQL queries / Line Protocol writes) over stdlib urllib — no extra Python package is required beyond the standard library (unlike the v1 backend which requires the influxdb package).

Note: The InfluxDB v3 backend is present and wired in the current codebase. It is newer than the sql and influx backends and has passed contract-level tests; mark it as less battle-tested than sql/influx for production use until further validation. See Data Sources for setup notes.

Option	Default	Description
host	http://localhost:8181	Base URL of the v3 server (scheme://host:port). If omitted, host and port are combined using the default port 8181.
token	(empty)	Bearer token for authentication. The environment variable INFLUXDB_V3_TOKEN takes precedence, so the token need not be written here. Leave empty for a --without-auth development server.
log_dbname	log	Database name for log-event time-series.
snmp_dbname	snmp	Database name for SNMP metric time-series.
snmp_source_dbname	snmp	Database name for raw SNMP source data.
batch_size	1000	Number of points per write batch.

---

[database_sql]

SQLite3 or MySQL settings for the default SQL evdb backend. Used when general.evdb = sql (the default).

Option	Default	Description
database	sqlite3	Database engine. Available: sqlite3, mysql. MySQL requires the MySQLdb (MySQL for Python) package.
sqlite3_filename	logdag.db	SQLite3 database file path (relative or absolute). Used when database = sqlite3.
mysql_host	localhost	MySQL server hostname. Used when database = mysql.
mysql_log_dbname	log	MySQL database name for log time-series.
mysql_snmp_dbname	snmp	MySQL database name for SNMP time-series.
mysql_user	test	MySQL username.
mysql_passwd	test	MySQL password.

---

[filter]

Pre-processing filters applied to event time-series before they enter the causal-inference step.

Pipeline control

Option	Default	Description
rules	sizetest, filter_periodic, remove_linear	Ordered, comma-separated list of filter rules to apply. Available rules: sizetest, filter_periodic, remove_periodic, remove_corr, remove_linear.
pre_count	5	Minimum number of event occurrences required for an event to be kept (applied as a size guard). Set to at least 3.
pre_term	6h	Observation period used for the pre_count guard.

Fourier / periodicity filter

Used by filter_periodic and remove_periodic.

Option	Default	Description
fourier_sample_rule	1d_10s, 7d_1m	Sampling rules for Fourier analysis (format: <duration>_<binsize>).
fourier_th_spec	0.4	Spectral power threshold for flagging periodic events.
fourier_th_eval	0.1	Evaluation threshold for confirming periodicity.
fourier_th_restore	0.5	Threshold for restoring a previously-filtered event if it no longer appears periodic.
fourier_peak_order	200	Maximum Fourier peak order to consider.

Linear / continuous-distribution filter

Used by remove_linear.

Option	Default	Description
linear_sample_rule	1d_10s	Sampling rule for linear-distribution analysis.
linear_count	10	Minimum sample count required for the linear test.
linear_th	0.5	Threshold for the linear-distribution test; events above this are removed.

Correlation filter

Used by remove_corr.

Option	Default	Description
corr_sample_rule	1d_10s	Sampling rule for correlation analysis.
corr_th	0.5	Correlation threshold above which events are removed.
corr_diff	1h, 1d	Lag differences used in correlation computation (comma-separated durations).

---

[dag]

Central settings for the causal DAG inference phase (phase 2). See Generating DAGs for how these drive the job structure.

Term and area

Option	Default	Description
whole_term	2112-09-01 00:00:00, 2112-10-01 00:00:00	Full analysis period. Override with your actual data range. Same format as general.evdb_whole_term.
source	log	Data sources included in DAG estimation. Available: log, snmp (comma-separated for both).
snmp_features	(empty)	SNMP features to use. If empty, all available features are used.
area	all	Target areas for DAG construction. all = all hosts in one area named "all"; each = one area per host (named by hostname); or a comma-separated list of named areas.
area_def	(empty)	Definitions for named areas listed in area.

Job windowing

Option	Default	Description
unit_term	30h	Duration of each analysis job window.
unit_diff	24h	Stride between successive job windows. With unit_term = 30h and unit_diff = 24h, adjacent windows overlap by 6 hours.

Conditional-independence test

Option	Default	Description
ci_bin_method	sequential	Method for discretizing event time-series into bins. Available: sequential (non-overlapping bins), slide (sliding window), radius (radius-based).
ci_bin_size	1m	Bin size for the conditional-independence test input.
ci_bin_diff	1m	Distance between bins in the CI test input. Ignored when ci_bin_method = sequential (the bin size is used instead).
ci_func	gsq	Conditional-independence test function. Available: fisherz, fisherz_bin, gsq, gsq_rlib.

Causal algorithm

Option	Default	Description
cause_algorithm	pc	Causal-discovery algorithm. Available: pc, lingam, pc-corr, lingam-corr. See Causal Discovery Methods.
skeleton_method	stable	PC skeleton-learning algorithm. stable = stable-PC (order-independent result); default = original PC (faster, less accurate on sparse data).
skeleton_depth	-1	Maximum conditioning-set depth for the PC skeleton search. -1 = no limit.
skeleton_threshold	0.01	p-value threshold for the conditional-independence test during skeleton learning.
skeleton_verbose	false	Enable verbose skeleton-learning output (for debugging).

Synchronised-event merging

Option	Default	Description
merge_syncevent	false	Merge event nodes that have completely identical time-series values.
merge_syncevent_rules	source, host, group	Attributes used to identify groups of synchronized events when merging.

Output and caching

Option	Default	Description
args_fn	args	Filename for the argument list (job enumeration) file written by make-args.
evmap_dir	(empty)	Directory for event-definition data. If empty, output_dir is used (with an extended filename). Currently unused; kept for compatibility.
output_dir	pc_output	Directory where DAG files are written. Each job creates a subdirectory <area>_<date>/ containing dag.pickle (or dag.json).
output_dag_format	pickle	Serialization format for DAG files. Available: pickle, json.
pass_dag_exists	false	Skip a job if the corresponding DAG file already exists on disk. Useful for resuming an interrupted run.
event_detail_head	5	Number of events shown at the start of event detail output.
event_detail_foot	5	Number of events shown at the end of event detail output.
event_detail_cache	true	Cache event detail data to disk for faster repeated display.

---

[prior_knowledge]

Injects structural constraints (prior knowledge about causal relationships) into the PC algorithm. See Causal Discovery Methods for context.

Method selection

Option	Default	Description
methods	(empty)	Comma-separated list of prior-knowledge methods to apply. Available: topology, multi-topology. Leave empty to disable prior knowledge.

Single-topology method

Used when methods includes topology.

Option	Default	Description
single_network_file	def_topology.json	Path to a NetworkX graph file (JSON format) representing the network topology. Edges constrain the DAG search space.

Multi-topology method

Used when methods includes multi-topology.

Option	Default	Description
multi_network_file	l2:l2.json, l3:l3.json	Comma-separated name:file pairs, each mapping a topology name to a NetworkX JSON file.
multi_network_group	interface:l2, network:l2, egp:l3, igp:l3, vpn:l3	Mapping from log-template group names (lt_label in amulog) to topology names.

DAG import

Option	Default	Description
import_config	(empty)	Path to a logdag config whose output DAG is imported as prior knowledge.
import_apply_rule	prune	How the imported DAG constraints are applied. Available: prune, force, prune+force, prune-unconnected.
import_allow_reverse	true	Allow reversed edges from the imported DAG when applying constraints.

---

[lingam]

Tuning parameters for the LiNGAM causal-discovery algorithm. Used when dag.cause_algorithm is lingam or lingam-corr.

Option	Default	Description
algorithm	ica	LiNGAM variant. ica = ICA-LiNGAM (LiNGAM-fast).
lower_limit	0.01	Minimum absolute connection strength threshold; connections below this are pruned.
ica_max_iter	1000	Maximum number of ICA iterations.

---

[eval]

Settings for the logdag.eval evaluation sub-tool, which compares DAG outputs against labelled ground truth.

Option	Default	Description
path	eval_data	Directory path for evaluation data files (trouble labels, etc.).

---

Section summary

Section	Role	Backend activated by
[general]	Feature-DB pipeline control	always
[database_amulog]	amulog log-event source	general.log_source = amulog
[database_rrd]	RRD SNMP source	general.snmp_source = rrd
[database_influx]	InfluxDB v1 feature DB	general.evdb = influx
[database_influx3]	InfluxDB 3 Core feature DB	general.evdb = influx3
[database_sql]	SQLite3 / MySQL feature DB	general.evdb = sql (default)
[filter]	Event pre-processing filters	always (when use_evdb = true)
[dag]	Causal DAG estimation	always
[prior_knowledge]	Structural constraints for PC	when dag.methods is non-empty
[lingam]	LiNGAM algorithm tuning	dag.cause_algorithm = lingam / lingam-corr
[eval]	Evaluation sub-tool	logdag.eval commands