{"componentChunkName":"component---src-components-mark-down-block-js","path":"/docs/edgescope-docker/","result":{"data":{"markdownRemark":{"html":"

Running AppScope With Cribl Edge in a Docker Container

\n

This topic walks you through a setup procedure, and then through the two basic AppScope techniques:

\n
    \n
  1. Scope by PID – Instrumenting one process on one host or container.
    2. \n
  2. Scope by Rule – Instrumenting multiple processes on an entire Edge Fleet.
    3. \n
\n

We assume that you have an Edge Leader running in Cribl.Cloud, you want to add a new Edge Node to its Fleet – and that that Edge Node will be in a Docker container (or another type of container that's also Open Container Initiative-compliant).

\n

We assume that your goal is to scope processes running on the host where the new Edge Node’s Docker container resides, or, that run on other containers on that host.

\n

You can easily modify these instructions to add more than one Edge Node and then use Scope by Rules to scope processes on the entire Fleet.

\n

Setting Up a New Edge Node

\n

In Cribl.Cloud:

\n
    \n
  1. Click Manage Edge.
    2. \n
  2. Select the Fleet where you’ll be adding a Linux host – default_fleet is fine.
    3. \n
  3. From the Add/Update Edge Node drop-down, select Docker to open the Add Docker Node modal.
    4. \n
  4. \n

    Click Copy script and dismiss the modal.

    \n\n
    5. \n
  5. Note the value of Edge Nodes at upper left.
    6. \n
\n

On the Linux host we want to observe with Edge:

\n
    \n
  1. Paste the script into the shell.
    2. \n
  2. \n

    Add  -v /var/run/appscope:/var/run/appscope to the script.

    \n\n
    3. \n
  3. Execute the script – this will run Edge in a Docker container.
    4. \n
\n

Return to Cribl.Cloud UI to verify that the new Node is present:

\n
    \n
  1. The value of Edge Nodes should have increased by 1.
    2. \n
  2. Select List View (and filtering by host if needed) – the new Edge Node should appear in the list.
    3. \n
\n

At this point, Edge is running in a Docker container and is connected to the Edge Leader.

\n

Scoping by PID

\n

Still in Edge’s List View tab:

\n
    \n
  1. Click the GUID for the host we’ve just added.
    2. \n
  2. Click the count of running processes at upper left to open a list view of processes.
    3. \n
\n

On the Linux host:

\n\n

Back in Edge:

\n

Within seconds, top should appear in the process list. (If you don’t see it, try filtering by command.) At this point top is running but is not yet instrumented by AppScope.

\n
    \n
  1. Select the top command's row to open the Process: top drawer.
    2. \n
  2. \n

    In the AppScope tab, select the AppScope Configuration we want to use for this process.

    \n\n
    3. \n
  3. \n

    Leave the default Source as in_appscope.

    \n\n
    4. \n
  4. \n

    Click Start monitoring.

    \n\n
    5. \n
\n

Now you’ll want to confirm that Edge is receiving AppScope data for the scoped top process.

\n

On the Edge Leader, navigate to More > Sources and select AppScope to open the Source page.

\n

In the row where ID is in_appscope:

\n\n

Scoping by Rule

\n

On the Linux host:

\n\n

On the Edge Leader:

\n\n

In the AppScope Rules tab, under Rules, click Add Rule and complete the Rule as follows:

\n\n

Next:

\n
    \n
  1. Click Save.
    2. \n
  2. Click Commit and provide a commit message.
    3. \n
  3. Click Commit and Deploy.
    4. \n
\n

Wait for the changes to be deployed to the Edge Node – probably around 30 seconds.

\n\n

Back on the Linux host:

\n
    \n
  1. In your shell, start another top process.
    2. \n
  2. Click the Live Data tab.
    3. \n
\n

You should now see events flowing from two top processes – they’ll have different PIDs.

\n

Return to Edge’s List View tab – the AppScope column should indicate that both top processes are being scoped.

\n

This gets to what’s so powerful about Rules: You can start processes after setting things up, and they get scoped.

\n

Optionally, you can try the other two configurations and see how the scoped data changes. For the config that has payloads enabled, curl and wget are good choices.

\n

If you want to do more, consider creating Routes and Pipelines in Cribl Edge, to send AppScope data to your favorite Destination(s).

","frontmatter":{"title":"Cribl Edge in Docker"}}},"pageContext":{"slug":"/edgescope-docker/","id":"025777e4-e686-51a1-aa6e-21ba23207be9"}},"staticQueryHashes":["2787008656","306729481","625673991","640077088"]}