msys.dp_config.audit_series.auth_user

msys.dp_config.audit_series.auth_user = {
  type = "string",
  interval = 900,
  buckets = 4,
  thresholds = {
    { check = true,
      startv = 0,
      endv = 3,
      threshold = 100,
      honor_whitelist = { "global" }
    }
  },
  options = {
    persist = true
  }
};

type

The only legal value for this element is string.

interval

The time interval that you wish to look at measured in seconds. A reasonable value might be 900.

buckets

A bucket is a window of time of the length defined by "interval". A reasonable value might be 4.

thresholds

thresholds is a nested table within this configuration option. The following list defines the attributes of the individual thresholds.

check

Whether or not to use this configuration item.

startv

The starting bucket (0 is the current bucket) to query across.

endv

The ending bucket.

threshold

When this count is exceeded, rejection happens. When this threshold is exceeded code 451 is issued along with the message Authenticated user rate limit exceeded.

honor_whitelist

A table listing any applicable whitelists set in the msys.dp_config.whitelist table.

options

This item is a table with the following possible keys:

serialize

Write audit series to log. The value may be true or false; false is the default.

When true, the log will be written to the directory defined by the serialize_dir option in the inbound_audit module. The default value for this option is /var/log/ecelerity/audit_series_persist.

replicate

Defaults to none, but can be cluster to send to all nodes, or manager to send only to cluster manager nodes. This requires explicit configuration in the cluster stanza to operate correctly. For more information see Data Replication.

persist

When set to true, the audit series will be persisted. The persisted series will be reloaded when the engine restarts. The default value is false.