AMINERREMOTECONTROL(1)
π aminerremotecontrol π
manual: logdata-anomaly-miner User Manual Β· section 1 π
πΈ NAME πΈ
aminerremotecontrol is a lightweight tool for log checking, log analysis β¨
π§ SYNOPSIS π§
aminerremotecontrol [[--exec command] | [--exec-file file ]]
[OPTIONS]...
π DESCRIPTION π
Okay so this is the quick intro to aminerremotecontrol π
It runs arbitrary remote control commands inside a running aminer child process. The child process usually has lowered privileges or SELinux/AppArmor confinement, so bestie, you might see weird results when it touches stuff outside the child, like files π For more details, check the packaged docs at /usr/share/doc/logdata-anomaly-miner π
π Example usecases π
Print a property of the running AminerConfig: π
/usr/bin/aminerremotecontrol --data '["LogResourceList"]' --exec ' print_config_property(analysis_context, "%s" % remote_control_data[0])'
Print the complete AminerConfig: π¦
/usr/bin/aminerremotecontrol --exec 'print_current_config(analysis_context)'
Print a property of the running AminerConfig, change it, and confirm the changed value by printing it again: π
/usr/bin/aminerremotecontrol --data '["Resources.MaxMemoryUsage", -1]' --exec ' print_config_property(analysis_context, "%s" % remote_control_data[0])' --exec 'change_config_property(analysis_context, "%s" % remote_control_data[0], remote_control_data[1])' --exec ' print_config_property(analysis_context, "%s" % remote_control_data[0])'
π¦ OPTIONS π¦
Long options start with two dashes ('-') π Here's the summary of the options. For the full tea, check the info(1) files β
--control-socket,-csocket β This is where you point to the Unix domain remote control socket path. If you don't pick one, it defaults to/var/run/aminer-remote.socket𧦠Aminer opens this socket when theRemoteControlSocketfeature is enabled in the configuration. It's aSOCK_STREAMsocket, so you can also forward it through other stream forwarders, like socat (seeUNIX-CONNECTandUNIX-LISTEN) and SSH (seeLocalForward,DynamicForward) β¨ Access control is only done by the socket's file system permissions (DAC), so be careful and don't widen the access on error π ββοΈ--exec,-ecommand β For each--exec, the next argument gets sent in its own remote execution request, using extra execution data (see--data). The command runs in a separate execution namespace with only a few variables added to the local one. For example, the execution data is available asremote_control_dataπ§ If you set the local variableremoteControlResponseinside the command, that object gets serialized with json and sent back in the response π--exec-file,-ffile β For each--exec-file, the named file is loaded and its content gets submitted exactly like--execwould, as if the content were passed in as a string π--data,-ddata β A json string that defines Python objects. It gets sent with all the following--execoperations until you change it with another--dataπ Heads up: there are size limits on requests, so very large data objects might go over them π The execution context exposes the data as the variableremote_control_data.--string-response,-sβ When this is set, the result doesn't go through repr. Instead, the returned object is turned into a plain string withstr(object)and printed, so quotation marks and newlines aren't escaped π«Ά
β οΈ WARNING: this might be insecure, bestie! Without escaping, the printed data can contain terminal control sequences that exploit vulnerabilities or a misconfigured terminal to run code with the privileges of the terminal or of the process calling aminerremotecontrol (usually root) π
π Commands π
π change_config_property(analysis_context,'property_name','value')
This lets you change properties of the AminerConfig at runtime π₯ Every property you want to change needs its own call to this method. It prints "property_name changed to value successfully." if it worked, or an individual message if something failed. Read more about which properties you can change in the Valid Property Names section β¨
π change_attribute_of_registered_analysis_component(analysis_context,'component_name','attribute','value')
This lets you change attributes of components in the AminerConfig at runtime π
Every attribute needs its own call. It prints "component_name.attribute changed to value successfully. " if the changes worked, or an individual message if they failed. The type of the new value must match the type of the old value of component_name.attribute π
Example:
aminerremotecontrol --exec "change_attribute_of_registered_analysis_component(analysis_context, 'NewMatchPath','learn_mode', False)"
π¦ rename_registered_analysis_component(analysis_context,'old_component_name','new_component_name')
Renames the component from old_component_name to new_component_name π¦ The component with old_component_name gets deleted from the registered components and then registered again under new_component_name π«
Example:
aminerremotecontrol --exec "rename_registered_analysis_component(analysis_context,'NewMatchPath','NewMatchPathDetector')"
π§ add_handler_to_atom_filter_and_register_analysis_component(analysis_context,'atom_handler',component,'component_name')
Adds the component to the atom_filter and registers it with the component_name πΈ
Example:
aminerremotecontrol --exec "add_handler_to_atom_filter_and_register_analysis_component(analysis_context, 'AtomFilter', NewMatchPathDetector(analysis_context.aminer_config, analysis_context.atomizer_factory.atom_handler_list, learn_mode=True),'NewMatchPathDet')"
π₯ print_config_property(analysis_context,'property_name')
Prints the property with the property_name from the current AminerConfig π
Example:
aminerremotecontrol --exec "print_config_property(analysis_context,'LogResourceList')"
π print_attribute_of_registered_analysis_component(analysis_context,'component_name','attribute')
Prints the attribute of the component with the component_name π«§
Example:
aminerremotecontrol --exec "print_attribute_of_registered_analysis_component(analysis_context,'NewMatchPath','learn_mode')"
allowlist_events_from_history
allowlist_events_from_history(analysis_context,'history_component_name',id_spec_list,allowlisting_data=None)
okay so this one is lowkey iconic π¦ It allowlists the events with the ids in the id_spec_list from the history. history_component_name has to be the registered component of the class VolatileLogarithmicBackoffEventHistory, and the allowlisting response comes back to you β¨
Example:
aminerremotecontrol --exec "allowlist_events_from_history(analysis_context,'VolatileLogarithmicBackoffEventHistory',[12,13,15])"
reopen_event_handler_streams
reopen_event_handler_streams(analysis_context)
this is the move when you're doing log rotation π It reopens all StreamPrinterEventHandler streams. Literally that's the whole thing π
Example:
aminerremotecontrol --exec "reopen_event_handler_streams(analysis_context)"
Valid Property Names π
bestie, these are the config properties you can tweak with change_config_property. Each one has a value type and a default, so read the vibes carefully πΈ
MailAlerting.TargetAddress
Value: 'E-Mail Address'
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.TargetAddress', 'root@localhost')"
This is where your alert e-mails get sent π If it's left undefined, no e-mail notification hooks get added at all.
MailAlerting.FromAddress
Value: 'E-Mail Address'
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.FromAddress', 'root@localhost')"
This is the sender address for your e-mail alerts π¨
MailAlerting.SubjectPrefix
Value: 'String'
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.SubjectPrefix', 'aminer Alerts:')"
This is the text that gets stuck in front of the standard aminer subject line π·οΈ It defaults to "aminer Alerts:".
MailAlerting.EventCollectTime
Value: Seconds (Integer)
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.EventCollectTime', 10)"
Once a first event sets off the alerting procedure, aminer waits this many seconds before actually sending the e-mail. Everything that shows up in that window gets collected and sent together in one e-mail, so your inbox stays chill π§ It defaults to 10 seconds.
MailAlerting.MinAlertGap
Value: Seconds (Integer)
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.MinAlertGap', 600)"
This is the minimum gap between two alert e-mails, so nothing gets spammy π«π§ Any events during this gap get collected and sent with the next report. It defaults to 600 seconds.
MailAlerting.MaxAlertGap
Value: Seconds (Integer)
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.MaxAlertGap', 1000)"
This is the maximum gap between two alert e-mails. If it's undefined, it just matches "MailAlerting.MinAlertGap". If it's set, you get an exponential backoff π which cuts down on messages during permanent error states. The alert gap goes up by 50% whenever more alert-worthy events come in while the previous gap hasn't elapsed yet. Very smart, very calm π§ β¨
MailAlerting.MaxEventsPerMessage
Value: Number of messages (Integer)
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'MailAlerting.MaxEventsPerMessage',1000)"
This caps how many events can go into one alert mail π¦ It defaults to 1000.
LogPrefix
Value: 'String'
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'LogPrefix','Original log line: ')"
Most analysis components implement the output_logline property, which is True by default. This lets you define a prefix for the original captured log lines πͺ§ It defaults to ''.
Resources.MaxMemoryUsage
Value: 'Allowed RAM usage in Megabytes (Integer: 32-maxSystemRAM)'
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'Resources.MaxMemoryUsage', -1)"
This one puts a ceiling on how much RAM (in MB) the aminer process is allowed to use π§’
Be careful with this one, bestie π If memory runs short, you'll get a MemoryError.
It defaults to -1, which means there's no limit.
Core.PersistencePeriod
Value: Seconds (Integer)
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'Core.PersistencePeriod', 300)"
This controls how often data gets persisted in the analysis components πΎ It defaults to 600 seconds.
Log.StatisticsLevel
Value: Level [0, 1, 2]
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'Log.StatisticsLevel',2)"
This changes how much data gets saved in statistics π Level 0 means no statistics, level 1 is the normal statistic level, and level 2 is verbose statistics. It defaults to 1.
Log.DebugLevel
Value: Level [0, 1, 2]
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'Log.DebugLevel',2)"
This changes the debug logging level π Level 0 means no logging, level 1 is normal output (INFO and above), and level 2 prints all debug information. It defaults to 1.
Log.StatisticsPeriod
Value: Seconds (Integer)
Example:
aminerremotecontrol --exec "change_config_property(analysis_context,'Log.StatisticsPeriod', 360)"
This sets how often statistics get logged and reset β° It defaults to 3600 seconds.
β¨ FILES β¨
/var/run/aminer-remote.socket
This is the default remote control socket. It's what gets used unless you change it with the --control-socket option π
β¨ BUGS β¨
Report bugs through your distribution's bug tracking system π For bugs in the software trunk, report them at https://bugs.launchpad.net/logdata-anomaly-miner/+filebug.
β¨ SEE ALSO β¨
β¨ AUTHOR β¨
Markus Wurzenberger <markus.wurzenberger@ait.ac.at> ποΈ
Wrote this manpage for the Debian system.
β¨ COPYRIGHT β¨
Copyright Β© 2016 Markus Wurzenberger π
This manual page was written for the Debian system, and others are welcome to use it too π
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 3 π
On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
That's a wrap on the logdata-anomaly-miner remote control page, bestie π«Ά It's dated 08/29/2025, and it's giving clean, organized, and totally slay ππ¦β¨
π¦ where this page comes from
- ubuntu questing: logdata-anomaly-miner 2.8.0-1
- π girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms