Integrator Configuration
The Integrator configuration covers service identity, worker pool sizing, all integration targets (InfluxDB, Splunk, Elastic, Kafka, Zabbix, Canopsis, ServiceNow, GLPI, Jira), notification channels, and data export.
Tip: you don’t have to write this file by hand — the Component Config Builder generates a ready-to-run
integrator.json from a few guided questions.
Service Configuration (integrator.json)
This file must be in the same directory as the executable.
Minimal Example
{
"name": "integrator1",
"port": "8060",
"logLevel": "info"
}
Full Example
{
"name": "integrator1",
"ip": "",
"port": "8060",
"location": "Datacenter-1",
"description": "Main data integration hub",
"logLevel": "info",
"nbworker": "4",
"queuesize": "10000",
"backupInterval": "24",
"nbDaysBackup": "336",
"maxBackups": "5",
"maxSize": "10",
"maxAge": "28",
"logCompress": "true",
"send2CSVEnabled": "false",
"send2JSONEnabled": "false",
"influxDBEnabled": "false",
"splunkEnabled": "false",
"elasticEnabled": "false",
"kafkaEnabled": "false",
"zabbixEnabled": "false",
"canopsisEnabled": "false",
"serviceNowEnabled": "false",
"glpiEnabled": "false",
"jiraEnabled": "false",
"smtpEnabled": "false"
}
Settings Reference
Identity & Network
| Field | Type | Description | Default |
|---|---|---|---|
name |
string | Unique integrator identifier | required |
ip |
string | Bind IP address (empty = all interfaces) | "" |
port |
string | TCP port for the REST API | "8060" |
location |
string | Geographic/logical location label | "" |
description |
string | Free-text description | "" |
Worker Pool
| Field | Type | Description | Default |
|---|---|---|---|
nbworker |
string | Number of worker goroutines processing the task queue | "4" |
queuesize |
string | Maximum tasks in the queue before dropping | "10000" |
notifBufferSize |
string | Max failed notifications held on disk for retry (oldest dropped when full) | "500" |
Sizing guidance: For high-volume environments (>1000 monitors), increase
nbworker to 8-16 and queuesize to 50000+. Each worker processes tasks sequentially, so more workers = more parallelism.
Data Management
| Field | Type | Description | Default |
|---|---|---|---|
backupInterval |
int | Hours between automated KV store backups | 24 |
nbDaysBackup |
int | Days to retain backup files | 336 |
Logging
| Field | Type | Description | Default |
|---|---|---|---|
logLevel |
string | debug, info, warn, error |
"info" |
maxBackups |
int | Rotated log files to keep | 5 |
maxSize |
int | Max log file size (MB) | 10 |
maxAge |
int | Max log file age (days) | 28 |
logCompress |
string | Compress rotated logs | "true" |
Correlation Engine
| Field | Type | Description | Default |
|---|---|---|---|
correlationEnabled |
string | Enable cross-agent root-cause correlation | "false" |
correlationWindowMinutes |
string | Minutes to look back for an upstream breach | "10" |
Opt-in. The correlation engine is disabled by default. When enabled, breaches on
url/api/tcp/db/ping/nslookup monitors are correlated against earlier upstream breaches that can be tied to the same host and that predate the failure, and the event is enriched with an rca object (plus an [RCA] log hint). The link may cross probes when it comes from a Sentinel Agent running on the target host (declared or address linkage) — never on probe identity alone. A monitor that was already failing before the candidate breached is never made its symptom. See Integrator — Cross-Agent Correlation Engine for the full model. Both fields can also be pushed live from the Webserver UI without restarting the service.
Integration Targets
| Field | Description |
|---|---|
influxDBEnabled |
"true" to enable |
influxDBVersion |
"1.x", "2.x", or "3.x" |
influxDBServer |
InfluxDB server hostname |
influxDBPort |
InfluxDB server port (e.g., "8086") |
influxDBIndex |
Database name (v1.x) |
influxDBOrg |
Organization (v2.x/v3.x) |
influxDBBucket |
Bucket name (v2.x/v3.x) |
influxDBToken |
Authentication token (v2.x/v3.x) |
influxDBUser |
Username (v1.x basic auth) |
influxDBPwd |
Password (v1.x basic auth) |
influxDBSSL |
"true" for HTTPS connection |
See Integration with InfluxDB for setup instructions.
| Field | Description |
|---|---|
splunkEnabled |
"true" to enable |
splunkCollectorServer |
Splunk HEC server hostname |
splunkCollectorPort |
HEC port (default: "8088") |
splunkAuthorizationToken |
HEC authorization token |
splunkIndex |
Target Splunk index |
splunkSSL |
"true" for HTTPS |
See Integration with Splunk for setup instructions.
| Field | Description |
|---|---|
elasticEnabled |
"true" to enable |
elasticServer |
Elasticsearch server hostname |
elasticPort |
Server port (default: "9200") |
elasticUser |
Username for basic auth |
elasticPwd |
Password for basic auth |
elasticSSL |
"true" for HTTPS |
See Integration with Elastic for setup instructions.
| Field | Description |
|---|---|
kafkaEnabled |
"true" to enable |
kafkaBrokers |
Comma-separated broker addresses (e.g., "broker1:9092,broker2:9092") |
kafkaTopic |
Target topic name |
kafkaTLS |
"true" for TLS connections |
kafkaCAFile |
Path to CA certificate file |
kafkaCertFile |
Path to client certificate |
kafkaKeyFile |
Path to client private key |
kafkaSASLMechanism |
SASL mechanism: "PLAIN", "SCRAM-SHA256", "SCRAM-SHA512" |
kafkaSASLUser |
SASL username |
kafkaSASLPwd |
SASL password |
| Field | Description |
|---|---|
zabbixEnabled |
"true" to enable |
zabbixServer |
Zabbix server hostname |
zabbixPort |
Zabbix API port |
zabbixAuthType |
"userPwd" or "token" |
zabbixUser |
Username (when authType is "userPwd") |
zabbixPwd |
Password (when authType is "userPwd") |
zabbixToken |
API token (when authType is "token") |
zabbixVersion |
Zabbix version (e.g., "6.x") |
zabbixSSL |
"true" for HTTPS |
See Integration with Zabbix for setup instructions.
| Field | Description |
|---|---|
canopsisEnabled |
"true" to enable |
canopsisServer |
Canopsis server hostname |
canopsisPort |
Server port |
canopsisUser |
Username |
canopsisPwd |
Password |
canopsisSSL |
"true" for HTTPS |
| Field | Description |
|---|---|
serviceNowEnabled |
"true" to enable |
serviceNowServer |
ServiceNow instance host (e.g. dev12345.service-now.com) |
serviceNowPort |
Server port (usually 443) |
serviceNowUser |
Integration user |
serviceNowPwd |
Password |
serviceNowSSL |
"true" for HTTPS |
serviceNowResolvedState |
Incident state set on auto-resolve (default 6 = Resolved) |
serviceNowCloseCode |
close_code set on auto-resolve (default Resolved by caller) |
serviceNowAutoResolve |
"true" (default) to auto-resolve on recovery. An incident a human has taken (assigned / past New) is never auto-closed — a recovery work note is posted instead |
serviceNowGraceSeconds |
Flap-dampening window in seconds before an incident is opened on breach. If the monitor recovers within the window the flap is suppressed and no incident is created. Default 0 = open immediately |
serviceNowIncidentScope |
How many incidents one outage is worth. "all" (default) = one incident per breaching monitor. "root" = an event the RCA engine tied to an earlier upstream failure opens no incident of its own; it is posted as a work note on the root cause’s incident instead. Requires correlationEnabled — with correlation off nothing is a symptom and every event still opens its own incident |
Opens an incident on breach and auto-resolves it on recovery, correlated by correlation_id.
| Field | Description |
|---|---|
glpiEnabled |
"true" to enable |
glpiServer |
GLPI host (e.g. glpi.example.com) |
glpiPort |
Server port (usually 443) |
glpiUser |
Integration user |
glpiPwd |
Password |
glpiAppToken |
API client App-Token (leave empty if the GLPI API client has none) |
glpiSSL |
"true" for HTTPS |
glpiSolvedStatus |
Ticket status set on auto-resolve (default 5 = Solved; 6 = Closed) |
glpiAutoResolve |
"true" (default) to auto-resolve on recovery. A ticket a human has taken (assigned / processing / pending) is never auto-closed — a recovery follow-up is posted instead |
glpiGraceSeconds |
Flap-dampening window in seconds before a ticket is opened on breach. If the monitor recovers within the window the flap is suppressed and no ticket is created. Default 0 = open immediately |
Opens a ticket on breach and auto-resolves it on recovery, correlated by an embedded key in the ticket title.
| Field | Description |
|---|---|
jiraEnabled |
"true" to enable |
jiraServer |
Jira Cloud host (e.g. your-domain.atlassian.net) |
jiraPort |
Server port (usually 443) |
jiraUser |
Account email (Basic auth user) |
jiraPwd |
API token (Basic auth password) |
jiraSSL |
"true" for HTTPS |
jiraProjectKey |
Target project key (e.g. OPS) where issues are created |
jiraIssueType |
Issue type for created issues (default Bug) |
jiraResolveTransition |
Workflow transition name used to auto-resolve (default Done) |
jiraAutoResolve |
"true" (default) to auto-resolve on recovery. An issue a human has taken (assigned / In Progress) is never auto-closed — a recovery comment is posted instead |
jiraGraceSeconds |
Flap-dampening window in seconds before an issue is opened on breach. Recovery within the window suppresses the flap (no issue). Default 0 = open immediately |
Opens an issue on breach and auto-resolves it (via a workflow transition) on recovery, correlated by a label matched with JQL.
Data Export
| Field | Type | Description | Default |
|---|---|---|---|
send2CSVEnabled |
string | Export data to CSV files in data/ |
"false" |
send2JSONEnabled |
string | Export data to JSON files in data/ |
"false" |
Notification Settings
How these settings combine with each monitor’s own switches, and when an alert is sent: Alert notifications.
Integrator-wide switches. A trigger switched off here is off for every monitor routed through this Integrator, whatever the monitor says. Set them in the Integrator’s Notifications block.
| Field | Description | Default |
|---|---|---|
emailOnF / emailOnSC |
Email on failure / on status change | "false" |
slackOnF / slackOnSC |
Slack on failure / on status change | "false" |
teamsOnF / teamsOnSC |
Teams on failure / on status change | "false" |
pdOnF / pdOnSC |
PagerDuty on failure / on status change | "false" |
scriptOnF / scriptOnSC |
Custom script on failure / on status change | "false" |
Used by a monitor that switches the channel on and leaves its own destination blank. A destination set on the monitor always wins, field by field. A default never switches a channel on.
| Field | Description |
|---|---|
defEmailR |
Default recipients (comma-separated) |
defSlackChan |
Default Slack channel (ID recommended) |
defSlackTok |
Default Slack bot token, xoxb-… (stored encrypted) |
defTeamsWH |
Default Teams Workflows webhook URL (stored encrypted) |
defPdAPI |
Default PagerDuty Events API V2 integration key (stored encrypted) |
defScriptAction |
Default script: a file name in scripts/, optionally followed by arguments |
defScriptActionT |
Timeout of the default script, in seconds (30 when empty or not positive) |
The SMTP server is not set in
integrator.json: it is pushed by the Webserver (Webserver settings → SMTP) to every enabled Integrator when those settings are saved — smtpEnabled, smtpServerName, smtpPort, smtpUsername, smtpPwd (encrypted), smtpTLS, and smtpTLSVerify (kept in the Integrator’s own store). See Email.
The legacy keys
slackChannel, slackToken, teamsWebhook and pagerDutyAPIKey, also pushed by the Webserver, are not used for monitor alerts. Use the default destinations above.
Security Notes
All sensitive fields (passwords, tokens, API keys, webhooks) are:
- Encrypted at rest using AES-256-GCM before storage in the embedded key-value store
- Never logged in plaintext – masked in debug output
- Protected by mutex for thread-safe access during configuration updates
The encryption key is generated during installation and stored in the config/sec/ directory.
Internal component secret (_sharedInternal)
The _sharedInternal key sets the password of the internal adminMNS machine account used for component-to-component API authentication (the Integrator uses it to log in to the Webserver, and the Webserver uses it to drive the Integrator). It must be identical in every component’s config (monitor.json, webserver.json, integrator.json, discovery_agent.json); a mismatch makes actions such as Enable and Push Settings fail with a bcrypt error. When empty, adminMNS is not created (fail-closed). See Internal component secret for details and rotation.