Services settings¶
Corelight-update service¶
When Corelight-update is installed, in addition to a corelight-update.service
, a system user and group are automatically created.
The service runs as the system user corelight-update
. However, it’s disabled by default.
To run Corelight-update as a service, enable the service and start it.
Enable the service:
sudo systemctl enable corelight-update.service
Start the service:
sudo systemctl start corelight-update.service
To view the status of the service:
systemctl status corelight-update.service
To monitor the logs from the service: The
-f
option makes the command follow the log until it’s canceled.sudo journalctl -f -u corelight-update
For more details on the service file, see Corelight-update service
Web service¶
The web service provides local web access to the documentation, and all of the content created and managed by Corelight-update. The web service is enabled by default, and is optional.
webserver: enable: true tls: true tls_cert: "/etc/corelight-update/global/cert.crt" tls_key: "/etc/corelight-update/global/cert.key" port: 8443
Note
Updating the default certificate is recommended.
Service interval¶
In some cases it is useful to disable the processing feeds and only have the web service enabled, or modify the default interval for processing data feeds.
process_feeds: true interval_minutes: "60"
When this interval is triggered,
All caches are updated.
All local data sources are copied to their respective working folders.
All remote data sources are copied to their respective working folders.
Additionally, the individual state history for each enabled integration is checked each interval.
If the integration interval time has lapsed, it processes the integration.
If the interval has not lapsed, the integration is skipped until the next cycle.
If the interval is set to
0
, the integrations will be processed each cycle.
For more details, see Order of operations
For details on updating the web service or service interval, see Updating the Global configuration
Attention
The web service and service interval only apply when running Corelight-update as a service. Any changes to these settings require a service restart to take affect.