On This Page

Home / Stream/ Integrations/ Sources/ System/System State Source

System State Source

The System State Source collects snapshots of the host system’s current state, on a configurable schedule, and sends them out as events to downstream systems for operational and security analytics.

Type: System | TLS Support: N/A | Event Breaker Support: No

Cribl Stream supports configuring only one System State Source per Worker Node and per Worker Group.

This Source is available in Cribl.Cloud on customer-managed hybrid Workers, but not on Cribl-managed Workers in Cribl.Cloud. It is also available on Windows, but only for Cribl Edge.

Configure Cribl Stream to Collect System State Events
​

  1. On the top bar, select Products, and then select Cribl Stream. Under Worker Groups, select a Worker Group. Next, you have two options:
    • To configure via QuickConnect, navigate to Routing > QuickConnect (Stream) or Collect (Edge). Select Add Source and select the Source you want from the list, choosing either Select Existing or Add New.
    • To configure via the Routes, select Data > Sources (Stream) or More > Sources (Edge). Select the Source you want. Next, select Add Source.
  2. Select the default in_system_state to open the configuration modal.
  3. Configure the following under General Settings:
    • Enabled: Toggle on to enable the Source.
    • Input ID: This is prefilled with the default value in_system_state, which cannot be changed via the UI, due to the single‑Source restrictions above.
    • Description: Optionally, enter a description.
  4. Next, you can configure the following Optional Settings:
    • Polling interval: How often to collect metrics, in seconds. Defaults to 10. Each run of the state collector generates events with identical _time values.
    • Tags: Optionally, add tags that you can use to filter and group Sources in Cribl Stream’s UI. These tags aren’t added to processed events. Use a tab or hard return between (arbitrary) tag names.
  5. Optionally, you can adjust the Collector, Processing, and Advanced settings, or Connected Destinations outlined in the sections below.
  6. Select Save, then Commit & Deploy.

Collector Settings
​

Cribl Stream contains the following System State collectors:

Host Info
​

With the Enabled toggle on (the default), Cribl Stream will create events based on entries collected from the hosts file.

A partial list of Host Info events includes:

  • host
  • hostOs (when Cribl Edge is running in a container)
  • timestamp
  • cribl.version
  • cribl.mode
  • cribl.group
  • cribl.config_version
  • os.arch
  • os.cpu_count

See the Explore > System State > Host Info UI for a full list of events.

The System State Source provides live system information, with most tabs updating periodically based on the Polling Interval configured in the Source. However, the data in the Host Info tab is collected once when the Source is started and does not update dynamically.

Disks and File Systems
​

With the Enabled toggle on (the default), Cribl Stream will collect entries on physical disks, partitions, and mounted filesystems. These entries can help you monitor drive status, including available space, percent utilization, inode availability, wait times, and number of blocks free.

On Cribl Edge, this option is available for Windows and Linux. You must create a different Worker Group for each OS. For details see, Mapping Edge Nodes to Fleets.

For each physical disk, Cribl Stream will collect:

  • name
  • size (in blocks)
  • blockSize (in bytes)
  • model
  • serial
  • firmware
  • partitions (count)
  • interface type

For each partition on a physical disk, Cribl Stream will collect:

  • disk (name)
  • disk ID (number)
  • type (primary or logical)
  • label
  • offset
  • size (in blocks)
  • blockSize (in bytes)
  • filesystem (mount point)

For each mounted filesystem, Cribl Stream will collect:

  • mount point (path)
  • disk (name)
  • partition (ID)
  • filesystem type
  • size (in blocks)
  • blockSize (in bytes)
  • blocksFree
  • inodes
  • inodesFree
  • flags

Mount point refers to the directory where a filesystem is currently mounted. This information reflects the active filesystems, not entries in the /etc/fstab file.

DNS
​

With the Enabled toggle on (the default), Cribl Stream will create events for DNS resolvers and search entries. The event field mapping depends on the operating system.

Linux
​

Cribl Stream emits events with the following fields:

Event FieldDescription
nameServerName server entries from the file.
searchSearch entries from the file.
sourceThe source of the data used to populate the event.
Windows (Cribl Edge Only)
​

Cribl Edge on Windows emits events with the following fields:

Event FieldDescription
ifAliasInterface alias name (if present).
ifIndexInterface index (if present).
addressFamilyIPv4 or IPv6.
nameServerArray of name servers.
searchArray of search suffixes .
sourceThe source of the data used to populate the event.

Hosts File
​

With the Enabled toggle on (the default), Cribl Stream will collect entries from the hosts file and emit them as events.

Examples of entries in the hosts file are:

  • ip: IP address of the host.
  • hostnames: list of hostnames per IP address.

Firewall
​

With the Enabled toggle on (the default), Cribl Stream will collect events from host’s defined firewall rules.

Chain Policy/References Rule(s) Event Fields
​

Cribl Stream emits events with the following fields:

  • chain: Name.
  • policy: Policy name.
  • pkts: Total bytes packets processed by the chain.
  • bytes: Total bytes processed by the chain.
  • references: Number of chains referencing the current chain.
Chain Rule(s) Event Fields
​

Cribl Stream emits events with the following fields:

  • chain: Name.
  • num: Rule sequence number.
  • pkts: Number of matched messages processed.
  • bytes: Cumulative packet size processed (bytes).
  • target: If the message matches the rule, the specified target is executed.
  • prot: The specified protocol can be one of tcp, udp, udplite, icmp, icmpv6, esp, ah, sctp, mh, or the special keyword all.
  • opt: Rarely used, this column is used to display IP options.
  • in: Inbound network interface.
  • out: Outbound network interface.
  • src: The source IP address or subnet of the traffic, the latter being anywhere.
  • dest: The destination IP address or subnet of the traffic, or anywhere.
  • match: ctstate, state, ADDRTYPE info added to a state field.
  • comment: Comment defined on the rule.
  • prot_family: IPv4 or IPv6.
Windows (Cribl Edge Only)
​

On Cribl Edge Windows, this collector emits events with the following fields:

  • ruleName: Rule Name.
  • displayName: Display Name.
  • direction: Specifies which direction of traffic to match with this rule. The acceptable values for this parameter are Inbound or Outbound.
  • enabled: True or False.
  • action: Specifies the action to take on traffic that matches this rule. The acceptable values for this parameter are Allow or Block.
  • group: Specifies the rule group (if applicable).
  • icmpType: Specifies the ICMP type used.
  • policyStoreSource: Contains a path to the policy store where the rule originated.
  • profile: Profile conditions associated with a rule.
  • protocol: protocols associated with firewall and IPsec rules.
  • localPort: Rules for local-only port mapping.
  • remotePort: Rules for remote port mapping.

Interfaces
​

With the Enabled toggle on (the default), Cribl Stream will create events for each of the host’s network interfaces.

Cribl Stream will create separate events for each entry. All events will have identical timestamp values.

Linux IPV4/IPV6
​

On Linux, Cribl Stream creates interface events with the following fields:

  • ifIndex: Interface index identification numbers.
  • ifName: The name of the network interface.
  • flags: Flags.
  • mtu: Maximum transmission unit (MTU) in bytes for packets sent on this interface.
  • operstate: Operational State.
  • linkType: Physical link type.
  • macAddress: Media Access Control address.
  • broadcast Broadcast address.
  • addrInfo: Array of {family, ipAddress, mask, prefix}.
Windows (Cribl Edge Only): IPV4/IPV6
​

On Windows, Cribl Edge creates interface events with the following fields:

  • ifIndex: Interface index identification numbers.
  • interface: The name of the network interface.
  • mtu: Maximum transmission unit (MTU) in bytes for packets sent on this interface.
  • flags: Flags.
  • macAddress: Media Access Control address.
  • addrInfo: Array of {family, ipAddress, mask, prefix}.

Listening Ports
​

With the Enabled toggle on (the default), Cribl Stream will create events from the list of listening ports and their associated process identifier (pid).

Cribl Stream will create separate events for each entry. All events will have identical timestamp values.

Sample entries include:

  • Protocol Family: ipv4 or ipv6.
  • Protocol: TCP, UDP, or UNIX.
  • Socket: ${addr}:${port}, or ${path} for UNIX sockets.
  • Process id: The process identifier.
  • Program: The program listening on the port.

Logged-In Users
​

With the Enabled toggle on (the default), Cribl Stream will collect entries from currently logged-in users.

Linux
​

Cribl Stream emits events with the following fields:

  • uid: User ID.
  • Last Login date: Last login date.
  • terminal: Type of the terminal device.
  • hostname: Display the hostname of the system, if the user is connected from a remote computer.
  • userName: Logon name of the user.
Windows (Cribl Edge Only)
​

Cribl Edge Windows emits events with the following fields:

  • userName: Login name of the user.
  • sessionName: rdp (Remote desktop/terminal services login session) or console (Direct login session).
  • id: Session ID.
  • state: active (Active session) or disc (Disconnected/inactive session).
  • logonTime: Date and time the user logged on.
  • source: Set to Query User.

Routes
​

With the Enabled toggle on (the default), Cribl Stream will collect entries from host’s network routes and emit them as events.

Sample entries include:

  • address_family: ipv4 or ipv6.
  • destination: The destination network or host.
  • prefix: Emits only from Linux IPv6.
  • flags: Flags.
  • gateway: The gateway address.
  • interface: Interface to which packets for this route will be sent.
  • ifIndex: Interface ID. Emits only from Windows.
  • mask: The netmask for the destination net. Emits only from Linux IPv4.
  • metric: The distance to the target.
  • sequence: Sequence number in the table.
  • source: The source of the data used to populate the event.

Services
​

With the Enabled toggle on (the default), Cribl Stream will create events for each configured service (for example systemd and initd) along with their enabled and running status.

Sample entries include:

  • Name: Name of the service.
  • Unit Activation Status: The high-level unit activation state, i.e. generalization of SUB for systemctl. For sysV system value can be enabled or disabled.
  • Unit Load Status: Reflects whether the unit definition was properly loaded. (Only systemctl).
  • Sub Unit Activation Status: The low-level unit activation state, values depend on unit type.
  • Description: Description of the service.

Users and Groups
​

With the Enabled toggle on (the default), Cribl Stream will create events for users and groups.

Linux
​

On Linux, Cribl Stream creates user events with the following fields:

  • username
  • fullname
  • loginShell
  • userHome
  • userid
  • primaryGroup (name of primary group, not group ID)
  • groups (list of group names)

Cribl Stream also creates group events with the following fields:

  • name
  • groupId
  • users
Windows (Cribl Edge Only)
​

On Windows, Cribl Edge creates user events with the following fields:

  • userName
  • fullname
  • description
  • groups

Cribl Edge also creates group events with the following fields:

  • name
  • description
  • users

Processing Settings
​

Fields
​

In this section, you can define new fields or modify existing ones using JavaScript expressions, similar to the Eval function.

  • The Name specifies the field name, which can either be a new field (unique within the event) or an existing field name to modify its value.
  • The Value is a JavaScript expression (enclosed in quotes or backticks) to compute the field’s value (can be a constant). Select this field’s advanced mode icon (far right) if you’d like to open a modal where you can work with sample data and iterate on results.

This flexibility means you can:

  • Add new fields to enrich the event.
  • Modify existing fields by overwriting their values.
  • Compute logic or transformations using JavaScript expressions.

Pre-Processing
​

Select a Pipeline (or Pack) from the drop-down to process this Source’s data. Required to configure this Source via Data Routes; optional to configure via Collect/QuickConnect.

Disk Spooling
​

Enable disk spooling: Whether to save metrics to disk. When toggled on, exposes this section’s remaining fields.

Bucket time span: The amount of time that data is held in each bucket before it’s written to disk. The default is 10 minutes (10m).

Max data size: Maximum disk space the persistent metrics can consume. Once reached, Cribl Stream will delete older data. Example values: 420 MB, 4 GB. Default value: 100 MB.

Max data age: How long to retain data. Once reached, Cribl Stream will delete older data. Example values: 2h, 4d. Default value: 24h (24 hours).

Compression: Currently locked to none. Cribl plans to add (optional) disk-spooling compression in a future release.

Path location: Path to write metrics to. Default value is $CRIBL_HOME/state/system_state.

Advanced Settings
​

Environment: If you’re using GitOps, optionally use this field to specify a single Git branch on which to enable this configuration. If empty, the config will be enabled everywhere.

Connected Destinations
​

Select Send to Routes to enable conditional routing, filtering, and cloning of this Source’s data via the Routing table.

Select QuickConnect to send this Source’s data to one or more Destinations via independent, direct connections.