Configuring Tracee

Tracee has many different options and settings that control how Tracee operates. This section presents available configuration options. To learn about how to apply configuration to Tracee, please refer to the CLI or Kubernetes specific guides.

A complete config file with all available options can be found here. Most of the options are documented in different sections in the documentation.

blob-perf-buffer-size: 1024
cache:
    type: none
    size: 1024

proctree:
    source: none
    cache:
        process: 8192
        thread: 4096

capabilities:
    bypass: false
    add:
        - cap_sys_admin
        - cap_syslog
    drop:
        - cap_chown

cri:
    - runtime:
        name: containerd
        socket: /var/run/containerd/containerd.sock
    - runtime:
        name: docker
        socket: /var/run/docker.sock

healthz: false
install-path: /tmp/tracee
listen-addr: :3366
log:
    level: info
    file: "/path/to/log/file.log"
    aggregate:
        enabled: true
        flush-interval: "5s"
    filters:
        libbpf: false
        in:
        msg:
            - SampleMessage1
            - SampleMessage2
        pkg:
            - package1
            - package2
        file:
            - file1.go
            - file2.go
        level:
            - warn
            - error
        regex:
            - ^pattern1
            - ^pattern2
        out:
        msg:
            - ExcludedMessage1
        pkg:
            - excludedPackage
        file:
            - excludedFile.go
        level:
            - debug
        regex:
            - ^excludedPattern

metrics: false
output:
    json:
        files:
            - stdout

    table:
        files:
            - /path/to/table1.out
            - /path/to/table2.out

    table-verbose:
        files:
            - stdout

    gob:
        files:
        - /path/to/gob1.out

    gotemplate:
        template: /path/to/my_template1.tmpl
        files:
            - /path/to/output1.out
            - /path/to/output2.out

    forward:
        - forward1:
            protocol: tcp
            user: user
            password: pass
            host: 127.0.0.1
            port: 24224
            tag: tracee1
        - forward2:
            protocol: udp
            user: user
            password: pass
            host: 127.0.0.1
            port: 24225
            tag: tracee2

    webhook:
        - webhook1:
            protocol: http
            host: localhost
            port: 8000
            timeout: 5s
            gotemplate: /path/to/template/test.tmpl
            content-type: application/json
        - webhook2:
            protocol: http
            host: localhost
            port: 9000
            timeout: 3s
            gotemplate: /path/to/template/test.tmpl
            content-type: application/json

    options:
        none: false
        stack-addresses: true
        exec-env: false
        relative-time: true
        exec-hash: dev-inode
        parse-arguments: true
        sort-events: false

perf-buffer-size: 1024
pprof: false
pyroscope: false
rego:
    partial-eval: true
    aio: true
signatures-dir: ""