Exec (cmd) Source

Example
yaml
sources:
   cmd_ls:
    type: cmd
    cmd: ls
    mode: scheduled    
    args:
     - -l
     - -h
    workingDir: /foo
    interval: 60   
    outputMode: consolidateOutput
    environment:
     CONFIGURED_ENV1: my_configured_env_1
     MY_ENV_VAR: $MY_ENV_VAR
    sink: my_humio
  cmd_tail:
   type: cmd
   cmd: tail
   mode: streaming
   args:
    - -F
   workingDir: /foo
   sink: my_humio
   powershell_monitor:
    type: cmd 
    cmd: powershell
    mode: scheduled
    interval: 300  # Run every 5 minutes
    args:
     - -NoProfile
     - -NonInteractive
     - -Command
     - |
      $computerInfo = Get-ComputerInfo
      $processes = Get-Process | Select-Object -First 5
      $memory = Get-CimInstance Win32_OperatingSystem | Select-Object FreePhysicalMemory, TotalVisibleMemorySize
   
      $result = @{
       'Hostname' = $computerInfo.CsName
       'OS_Version' = $computerInfo.WindowsVersion
       'Top_Processes' = ($processes | ForEach-Object { $_.ProcessName }) -join ','
       'Free_Memory_GB' = [math]::Round($memory.FreePhysicalMemory/1MB, 2)
       'Total_Memory_GB' = [math]::Round($memory.TotalVisibleMemorySize/1MB, 2)
       'Timestamp' = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
      }
   
      ConvertTo-Json -InputObject $result
   sink: my_humio
  sinks:
   my_humio:
    type: humio
    token: $INGEST_TOKEN_REPO2  # "or an environment variable"
    url: https://cloud.us.humio.com
    compression: gzip
    compressionLevel: 9
    tls:
     insecure: false
     caCert: |
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----
     caFile: /etc/ssl/cert.pem
    proxy: none
  queue:
   fullAction: deleteOldest
   memory:
    flushTimeOutInMillisecond: 200
    maxLimitInMB: 1024
Introduction

This configuration captures system data by executing shell and PowerShell commands using the Exec source. It supports scheduled or streaming nodes and allows customization via environment variables.

Step-by-Step
  1. yaml
    sources:
   cmd_ls:
    type: cmd
    cmd: ls
    mode: scheduled    
    args:
     - -l
     - -h
    workingDir: /foo
    interval: 60   
    outputMode: consolidateOutput
    environment:
     CONFIGURED_ENV1: my_configured_env_1
     MY_ENV_VAR: $MY_ENV_VAR
    sink: my_humio

    This fragment defines a cmd_ls source using the ls command in scheduled mode with arguments, environment variables, and an target sink.

  2. yaml
    cmd_tail:
   type: cmd
   cmd: tail
   mode: streaming
   args:
    - -F
   workingDir: /foo
   sink: my_humio

    This fragment defines cmd_tail source running the tail command in streaming mode for continuous real-time output.

  3. yaml
    powershell_monitor:
    type: cmd 
    cmd: powershell
    mode: scheduled
    interval: 300  # Run every 5 minutes
    args:
     - -NoProfile
     - -NonInteractive
     - -Command
     - |
      $computerInfo = Get-ComputerInfo
      $processes = Get-Process | Select-Object -First 5
      $memory = Get-CimInstance Win32_OperatingSystem | Select-Object FreePhysicalMemory, TotalVisibleMemorySize
   
      $result = @{
       'Hostname' = $computerInfo.CsName
       'OS_Version' = $computerInfo.WindowsVersion
       'Top_Processes' = ($processes | ForEach-Object { $_.ProcessName }) -join ','
       'Free_Memory_GB' = [math]::Round($memory.FreePhysicalMemory/1MB, 2)
       'Total_Memory_GB' = [math]::Round($memory.TotalVisibleMemorySize/1MB, 2)
       'Timestamp' = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
      }
   
      ConvertTo-Json -InputObject $result
   sink: my_humio

    This fragment defines an Exec source using PowerShell to collect system metrics every 5 minutes. The output is formatted as JSON and sent to the my_humio sink.

  4. yaml
    sinks:
   my_humio:
    type: humio
    token: $INGEST_TOKEN_REPO2  # "or an environment variable"
    url: https://cloud.us.humio.com
    compression: gzip
    compressionLevel: 9
    tls:
     insecure: false
     caCert: |
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----
     caFile: /etc/ssl/cert.pem
    proxy: none

    This fragment configures the my_humio sink for the Exec source, including token authentication, compression settings, TLS details, and certification path.

  5. yaml
    queue:
   fullAction: deleteOldest
   memory:
    flushTimeOutInMillisecond: 200
    maxLimitInMB: 1024

    This fragment configures a memory-based queue with a flush timeout of 200ms and a maximum size of 1024MB. Oldest data is deleted when full.

  6. Event Result set.

Summary and Results

This example demonstrates Exec source configuration using both standard shell and PowerShell commands. It highlights command scheduling, environment variable usage, and JSON-formatted output sent to a configured sink.