AMINERREMOTECONTROL(1)

πŸ’– aminerremotecontrol πŸ’–

manual: logdata-anomaly-miner User Manual Β· section 1 πŸŽ€

🌸 NAME 🌸

aminerremotecontrol is a lightweight tool for log checking, log analysis ✨

🧚 SYNOPSIS 🧚

aminerremotecontrol [[--exec command] | [--exec-file file ]]
                    [OPTIONS]...

πŸŽ€ DESCRIPTION πŸŽ€

Okay so this is the quick intro to aminerremotecontrol πŸ’… It runs arbitrary remote control commands inside a running aminer child process. The child process usually has lowered privileges or SELinux/AppArmor confinement, so bestie, you might see weird results when it touches stuff outside the child, like files 😭 For more details, check the packaged docs at /usr/share/doc/logdata-anomaly-miner πŸ“š

πŸ’… Example usecases πŸ’…

Print a property of the running AminerConfig: 🌈

/usr/bin/aminerremotecontrol --data '["LogResourceList"]' --exec ' print_config_property(analysis_context, "%s" % remote_control_data[0])'

Print the complete AminerConfig: πŸ¦‹

/usr/bin/aminerremotecontrol --exec 'print_current_config(analysis_context)'

Print a property of the running AminerConfig, change it, and confirm the changed value by printing it again: πŸ‘‘

/usr/bin/aminerremotecontrol --data '["Resources.MaxMemoryUsage", -1]' --exec ' print_config_property(analysis_context, "%s" % remote_control_data[0])' --exec 'change_config_property(analysis_context, "%s" % remote_control_data[0], remote_control_data[1])' --exec ' print_config_property(analysis_context, "%s" % remote_control_data[0])'

πŸ¦‹ OPTIONS πŸ¦‹

Long options start with two dashes ('-') πŸ’œ Here's the summary of the options. For the full tea, check the info(1) files β˜•

  • --control-socket, -c socket β€” This is where you point to the Unix domain remote control socket path. If you don't pick one, it defaults to /var/run/aminer-remote.socket 🧦 Aminer opens this socket when the RemoteControlSocket feature is enabled in the configuration. It's a SOCK_STREAM socket, so you can also forward it through other stream forwarders, like socat (see UNIX-CONNECT and UNIX-LISTEN) and SSH (see LocalForward, DynamicForward) ✨ Access control is only done by the socket's file system permissions (DAC), so be careful and don't widen the access on error πŸ™…β€β™€οΈ
  • --exec, -e command β€” For each --exec, the next argument gets sent in its own remote execution request, using extra execution data (see --data). The command runs in a separate execution namespace with only a few variables added to the local one. For example, the execution data is available as remote_control_data 🧚 If you set the local variable remoteControlResponse inside the command, that object gets serialized with json and sent back in the response πŸ’Œ
  • --exec-file, -f file β€” For each --exec-file, the named file is loaded and its content gets submitted exactly like --exec would, as if the content were passed in as a string πŸ“„
  • --data, -d data β€” A json string that defines Python objects. It gets sent with all the following --exec operations until you change it with another --data πŸ“ Heads up: there are size limits on requests, so very large data objects might go over them πŸ™ˆ The execution context exposes the data as the variable remote_control_data.
  • --string-response, -s β€” When this is set, the result doesn't go through repr. Instead, the returned object is turned into a plain string with str(object) and printed, so quotation marks and newlines aren't escaped 🫢
⚠️ WARNING: this might be insecure, bestie! Without escaping, the printed data can contain terminal control sequences that exploit vulnerabilities or a misconfigured terminal to run code with the privileges of the terminal or of the process calling aminerremotecontrol (usually root) πŸ’€

πŸ‘‘ Commands πŸ‘‘

πŸ’– change_config_property(analysis_context,'property_name','value')

This lets you change properties of the AminerConfig at runtime πŸ”₯ Every property you want to change needs its own call to this method. It prints "property_name changed to value successfully." if it worked, or an individual message if something failed. Read more about which properties you can change in the Valid Property Names section ✨

🌈 change_attribute_of_registered_analysis_component(analysis_context,'component_name','attribute','value')

This lets you change attributes of components in the AminerConfig at runtime πŸ’… Every attribute needs its own call. It prints "component_name.attribute changed to value successfully. " if the changes worked, or an individual message if they failed. The type of the new value must match the type of the old value of component_name.attribute πŸŽ€

Example:

aminerremotecontrol --exec "change_attribute_of_registered_analysis_component(analysis_context, 'NewMatchPath','learn_mode', False)"

πŸ¦‹ rename_registered_analysis_component(analysis_context,'old_component_name','new_component_name')

Renames the component from old_component_name to new_component_name πŸ¦‹ The component with old_component_name gets deleted from the registered components and then registered again under new_component_name πŸ’«

Example:

aminerremotecontrol --exec "rename_registered_analysis_component(analysis_context,'NewMatchPath','NewMatchPathDetector')"

🧚 add_handler_to_atom_filter_and_register_analysis_component(analysis_context,'atom_handler',component,'component_name')

Adds the component to the atom_filter and registers it with the component_name 🌸

Example:

aminerremotecontrol --exec "add_handler_to_atom_filter_and_register_analysis_component(analysis_context, 'AtomFilter', NewMatchPathDetector(analysis_context.aminer_config, analysis_context.atomizer_factory.atom_handler_list, learn_mode=True),'NewMatchPathDet')"

Prints the property with the property_name from the current AminerConfig πŸ‘€

Example:

aminerremotecontrol --exec "print_config_property(analysis_context,'LogResourceList')"

Prints the attribute of the component with the component_name 🫧

Example:

aminerremotecontrol --exec "print_attribute_of_registered_analysis_component(analysis_context,'NewMatchPath','learn_mode')"

allowlist_events_from_history

allowlist_events_from_history(analysis_context,'history_component_name',id_spec_list,allowlisting_data=None)

okay so this one is lowkey iconic πŸ¦‹ It allowlists the events with the ids in the id_spec_list from the history. history_component_name has to be the registered component of the class VolatileLogarithmicBackoffEventHistory, and the allowlisting response comes back to you ✨

Example:

aminerremotecontrol --exec "allowlist_events_from_history(analysis_context,'VolatileLogarithmicBackoffEventHistory',[12,13,15])"

reopen_event_handler_streams

reopen_event_handler_streams(analysis_context)

this is the move when you're doing log rotation πŸ”„ It reopens all StreamPrinterEventHandler streams. Literally that's the whole thing πŸ’…

Example:

aminerremotecontrol --exec "reopen_event_handler_streams(analysis_context)"

Valid Property Names πŸŽ€

bestie, these are the config properties you can tweak with change_config_property. Each one has a value type and a default, so read the vibes carefully 🌸

MailAlerting.TargetAddress

Value: 'E-Mail Address'

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.TargetAddress', 'root@localhost')"

This is where your alert e-mails get sent πŸ’Œ If it's left undefined, no e-mail notification hooks get added at all.

MailAlerting.FromAddress

Value: 'E-Mail Address'

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.FromAddress', 'root@localhost')"

This is the sender address for your e-mail alerts πŸ“¨

MailAlerting.SubjectPrefix

Value: 'String'

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.SubjectPrefix', 'aminer Alerts:')"

This is the text that gets stuck in front of the standard aminer subject line 🏷️ It defaults to "aminer Alerts:".

MailAlerting.EventCollectTime

Value: Seconds (Integer)

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.EventCollectTime', 10)"

Once a first event sets off the alerting procedure, aminer waits this many seconds before actually sending the e-mail. Everything that shows up in that window gets collected and sent together in one e-mail, so your inbox stays chill 🧘 It defaults to 10 seconds.

MailAlerting.MinAlertGap

Value: Seconds (Integer)

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.MinAlertGap', 600)"

This is the minimum gap between two alert e-mails, so nothing gets spammy πŸš«πŸ“§ Any events during this gap get collected and sent with the next report. It defaults to 600 seconds.

MailAlerting.MaxAlertGap

Value: Seconds (Integer)

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.MaxAlertGap', 1000)"

This is the maximum gap between two alert e-mails. If it's undefined, it just matches "MailAlerting.MinAlertGap". If it's set, you get an exponential backoff πŸ“ˆ which cuts down on messages during permanent error states. The alert gap goes up by 50% whenever more alert-worthy events come in while the previous gap hasn't elapsed yet. Very smart, very calm 🧠✨

MailAlerting.MaxEventsPerMessage

Value: Number of messages (Integer)

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.MaxEventsPerMessage',1000)"

This caps how many events can go into one alert mail πŸ“¦ It defaults to 1000.

LogPrefix

Value: 'String'

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'LogPrefix','Original log line: ')"

Most analysis components implement the output_logline property, which is True by default. This lets you define a prefix for the original captured log lines πŸͺ§ It defaults to ''.

Resources.MaxMemoryUsage

Value: 'Allowed RAM usage in Megabytes (Integer: 32-maxSystemRAM)'

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'Resources.MaxMemoryUsage', -1)"

This one puts a ceiling on how much RAM (in MB) the aminer process is allowed to use 🧒

Be careful with this one, bestie 😭 If memory runs short, you'll get a MemoryError.

It defaults to -1, which means there's no limit.

Core.PersistencePeriod

Value: Seconds (Integer)

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'Core.PersistencePeriod', 300)"

This controls how often data gets persisted in the analysis components πŸ’Ύ It defaults to 600 seconds.

Log.StatisticsLevel

Value: Level [0, 1, 2]

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'Log.StatisticsLevel',2)"

This changes how much data gets saved in statistics πŸ“Š Level 0 means no statistics, level 1 is the normal statistic level, and level 2 is verbose statistics. It defaults to 1.

Log.DebugLevel

Value: Level [0, 1, 2]

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'Log.DebugLevel',2)"

This changes the debug logging level πŸ” Level 0 means no logging, level 1 is normal output (INFO and above), and level 2 prints all debug information. It defaults to 1.

Log.StatisticsPeriod

Value: Seconds (Integer)

Example:

aminerremotecontrol --exec "change_config_property(analysis_context,'Log.StatisticsPeriod', 360)"

This sets how often statistics get logged and reset ⏰ It defaults to 3600 seconds.


✨ FILES ✨

/var/run/aminer-remote.socket

This is the default remote control socket. It's what gets used unless you change it with the --control-socket option πŸ”Œ


✨ BUGS ✨

Report bugs through your distribution's bug tracking system πŸ› For bugs in the software trunk, report them at https://bugs.launchpad.net/logdata-anomaly-miner/+filebug.


✨ SEE ALSO ✨

aminer(1)


✨ AUTHOR ✨

Markus Wurzenberger <markus.wurzenberger@ait.ac.at> πŸ–ŠοΈ

Wrote this manpage for the Debian system.


Copyright Β© 2016 Markus Wurzenberger πŸ’œ

This manual page was written for the Debian system, and others are welcome to use it too 🌈

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 3 πŸ“œ

On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.


That's a wrap on the logdata-anomaly-miner remote control page, bestie 🫢 It's dated 08/29/2025, and it's giving clean, organized, and totally slay πŸ’–πŸ¦‹βœ¨

πŸ“¦ where this page comes from