The Integrator configuration covers service identity, worker pool sizing, all integration targets (InfluxDB, Splunk, Elastic, Kafka, Zabbix, Canopsis, ServiceNow, GLPI, Jira), notification channels, and data export.
Tip: you don’t have to write this file by hand — the Component Config Builder generates a ready-to-run integrator.json from a few guided questions.
Service Configuration (integrator.json)
This file must be in the same directory as the executable.
{"name":"integrator1","ip":"","port":"8052","location":"Datacenter-1","description":"Main data integration hub","logLevel":"info","nbworker":"4","queuesize":"10000","backupInterval":"24","nbDaysBackup":"336","maxBackups":"5","maxSize":"10","maxAge":"28","logCompress":"true","send2CSVEnabled":"false","send2JSONEnabled":"false","influxDBEnabled":"false","splunkEnabled":"false","elasticEnabled":"false","kafkaEnabled":"false","zabbixEnabled":"false","canopsisEnabled":"false","serviceNowEnabled":"false","glpiEnabled":"false","jiraEnabled":"false","smtpEnabled":"false"}
Settings Reference
Identity & Network
Field
Type
Description
Default
name
string
Unique integrator identifier
required
ip
string
Bind IP address (empty = all interfaces)
""
port
string
TCP port for the REST API
"8052"
location
string
Geographic/logical location label
""
description
string
Free-text description
""
Worker Pool
Field
Type
Description
Default
nbworker
string
Number of worker goroutines processing the task queue
"4"
queuesize
string
Maximum tasks in the queue before dropping
"10000"
notifBufferSize
string
Max failed notifications held on disk for retry (oldest dropped when full)
"500"
Sizing guidance: For high-volume environments (>1000 monitors), increase nbworker to 8-16 and queuesize to 50000+. Each worker processes tasks sequentially, so more workers = more parallelism.
Data Management
Field
Type
Description
Default
backupInterval
int
Hours between automated KV store backups
24
nbDaysBackup
int
Days to retain backup files
336
Logging
Field
Type
Description
Default
logLevel
string
debug, info, warn, error
"info"
maxBackups
int
Rotated log files to keep
5
maxSize
int
Max log file size (MB)
10
maxAge
int
Max log file age (days)
28
logCompress
string
Compress rotated logs
"true"
Correlation Engine
Field
Type
Description
Default
correlationEnabled
string
Enable cross-agent root-cause correlation
"false"
correlationWindowMinutes
string
Minutes to look back for an upstream breach
"10"
Opt-in. The correlation engine is disabled by default. When enabled, breaches on url/api/tcp/db/ping/nslookup monitors are correlated against earlier upstream breaches that can be tied to the same hostand that predate the failure, and the event is enriched with an rca object (plus an [RCA] log hint). The link may cross probes when it comes from a Sentinel Agent running on the target host (declared or address linkage) — never on probe identity alone. A monitor that was already failing before the candidate breached is never made its symptom. See Integrator — Cross-Agent Correlation Engine for the full model. Both fields can also be pushed live from the Webserver UI without restarting the service.
Incident state set on auto-resolve (default 6 = Resolved)
serviceNowCloseCode
close_code set on auto-resolve (default Resolved by caller)
serviceNowAutoResolve
"true" (default) to auto-resolve on recovery. An incident a human has taken (assigned / past New) is never auto-closed — a recovery work note is posted instead
serviceNowGraceSeconds
Flap-dampening window in seconds before an incident is opened on breach. If the monitor recovers within the window the flap is suppressed and no incident is created. Default 0 = open immediately
serviceNowIncidentScope
How many incidents one outage is worth. "all" (default) = one incident per breaching monitor. "root" = an event the RCA engine tied to an earlier upstream failure opens no incident of its own; it is posted as a work note on the root cause’s incident instead. Requires correlationEnabled — with correlation off nothing is a symptom and every event still opens its own incident
Opens an incident on breach and auto-resolves it on recovery, correlated by correlation_id.
Field
Description
glpiEnabled
"true" to enable
glpiServer
GLPI host (e.g. glpi.example.com)
glpiPort
Server port (usually 443)
glpiUser
Integration user
glpiPwd
Password
glpiAppToken
API client App-Token (leave empty if the GLPI API client has none)
glpiSSL
"true" for HTTPS
glpiSolvedStatus
Ticket status set on auto-resolve (default 5 = Solved; 6 = Closed)
glpiAutoResolve
"true" (default) to auto-resolve on recovery. A ticket a human has taken (assigned / processing / pending) is never auto-closed — a recovery follow-up is posted instead
glpiGraceSeconds
Flap-dampening window in seconds before a ticket is opened on breach. If the monitor recovers within the window the flap is suppressed and no ticket is created. Default 0 = open immediately
Opens a ticket on breach and auto-resolves it on recovery, correlated by an embedded key in the ticket title.
Field
Description
jiraEnabled
"true" to enable
jiraServer
Jira Cloud host (e.g. your-domain.atlassian.net)
jiraPort
Server port (usually 443)
jiraUser
Account email (Basic auth user)
jiraPwd
API token (Basic auth password)
jiraSSL
"true" for HTTPS
jiraProjectKey
Target project key (e.g. OPS) where issues are created
jiraIssueType
Issue type for created issues (default Bug)
jiraResolveTransition
Workflow transition name used to auto-resolve (default Done)
jiraAutoResolve
"true" (default) to auto-resolve on recovery. An issue a human has taken (assigned / In Progress) is never auto-closed — a recovery comment is posted instead
jiraGraceSeconds
Flap-dampening window in seconds before an issue is opened on breach. Recovery within the window suppresses the flap (no issue). Default 0 = open immediately
Opens an issue on breach and auto-resolves it (via a workflow transition) on recovery, correlated by a label matched with JQL.
Data Export
Field
Type
Description
Default
send2CSVEnabled
string
Export data to CSV files in data/
"false"
send2JSONEnabled
string
Export data to JSON files in data/
"false"
Notification Settings
Field
Description
smtpEnabled
"true" to enable email notifications
smtpServerName
SMTP server hostname
smtpPort
SMTP port (25, 465, 587)
smtpUsername
SMTP username
smtpPwd
SMTP password (stored encrypted)
smtpTLS
"true" for TLS
Field
Description
slackChannel
Default notification channel
slackToken
Bot token (stored encrypted)
Field
Description
teamsWebhook
Incoming webhook URL (stored encrypted)
Field
Description
pagerDutyAPIKey
API key for incident creation (stored encrypted)
Field
Description
emailOnF
Send email on failure
emailOnSC
Send email on status change
slackOnF
Send Slack on failure
slackOnSC
Send Slack on status change
teamsOnF
Send Teams on failure
teamsOnSC
Send Teams on status change
pdOnF
Send PagerDuty on failure
pdOnSC
Send PagerDuty on status change
scriptOnF
Run script on failure
scriptOnSC
Run script on status change
Security Notes
All sensitive fields (passwords, tokens, API keys, webhooks) are:
Encrypted at rest using AES-256-GCM before storage in the embedded key-value store
Never logged in plaintext – masked in debug output
Protected by mutex for thread-safe access during configuration updates
The encryption key is generated during installation and stored in the config/sec/ directory.
Internal component secret (_sharedInternal)
The _sharedInternal key sets the password of the internal adminMNS machine account used for component-to-component API authentication (the Integrator uses it to log in to the Webserver, and the Webserver uses it to drive the Integrator). It must be identical in every component’s config (monitor.json, webserver.json, integrator.json, discovery_agent.json); a mismatch makes actions such as Enable and Push Settings fail with a bcrypt error. When empty, adminMNS is not created (fail-closed). See Internal component secret for details and rotation.