Location overrides
Most of the time the agent finds real paths on its own. It parses the running service, not
defaults: nginx -T for the access log, mysqladmin variables for the datadir and socket
and slow log, the php-fpm pool socket, the systemd ExecStart, and so on. A log in
/www/logs instead of /var/log is found, not assumed.
When discovery cannot see a path (a log shipped to a place the service's own config does not mention), you can override it. Precedence is explicit override first, then auto-discovery.
- Auto-discovery (default): the agent reads the real config as described above.
- The CLI:
wakora --set <service>.<key>=<value>writes the override and exits. - Local
wakora.conf: the same INI file, edited directly. Good for golden images or air-gapped setups.
Everything ends up in the same wakora.conf, so there is one place to look. Manual edits
apply on agent restart.
Two more sources for the same overrides are planned: installer long-form flags at
bootstrap (for example --nginx-access-log=/www/logs on the install one-liner) and
per-host overrides pushed from the console (fully configless for fleets). Both persist
into the same wakora.conf.
How a key is matched
An override shadows a discovered fact of that service: the section is the service
name as the console shows it, the key is the fact the probe reads its path from. Both
spellings of the key work, the fact name as is (accessLog) or kebab-case
(access-log). Overrides apply to path-typed facts; listening ports and sockets always
come from live discovery and cannot be overridden here.
A value can be a single path or a comma-separated list where the service legitimately
has several files. When the fact is a directory (the PostgreSQL log directory), the
newest *.log inside it is tailed.
Keys the shipped catalog reads
| Section | Keys | What it points at |
|---|---|---|
[nginx] | access-log, error-log | Access log (RED rates and shipping), error log. |
[apache] / [httpd] | access-log, error-log | Same, for either Apache flavor. |
[mysql] | slow-log, error-log | Slow query log, server error log. |
[postgres] | log-dir | The log directory; the newest .log in it is tailed. |
[redis] | log-file | Server log. |
[mongo] | log-path | Server log. |
[clickhouse] | log-path, err-log-path | Main and error logs. |
[dovecot] / [exim] | log-path | Mail logs. |
[bind] | query-log | Query log (feeds the query rate). |
[vsftpd] | log-file | Transfer log. |
[php-fpm] | conf-file, error-log | The php-fpm config to derive pool facts from, and the error log. |
[node] | pm2-logs-err, pm2-logs-out | pm2 log files, when the daemon's own answer is wrong. |
[mssql] | error-log | ERRORLOG path (Windows). |
[iis] | access-log | W3C log directories (Windows). |
[backup] | path | The directory whose freshness the generic backup check watches. Setting it is what activates that check. |
[borg] / [restic] | repo | Repository path for the age check. |
The list grows with the catalog: any new definition that reads a path from a discovered fact accepts an override under that fact's name automatically.
The [agent] section
The same file carries the agent's own few switches, each documented on its page:
| Key | What it does |
|---|---|
baseline | true holds all probes (Baseline mode). |
pin | Pin the agent to an exact release (Updates). |
otlp-port, otlp-bind | The local OTLP receiver (Local ingest ports). |
custom-metrics-port | The custom metrics endpoint (Local ingest ports). |
wakora.conf format
INI with MySQL-style sections. It contains non-secret overrides only. It never contains a key, an endpoint, or an update URL.
[nginx]
access-log = /www/logs/access.log
[mysql]
slow-log = /var/log/mysql-custom/slow.log
Setting an override from the CLI
wakora --set nginx.access-log=/www/logs/access.log
This writes the value into wakora.conf and exits. The change applies on the next agent
start.
Only non-secret values
Location overrides are paths. They are not secrets, so they can safely come from a flag or a file. Credentials go through a different, local-only path. See Secrets.