The Event Logging Agent is responsible for collecting events from the Event Logging listeners: to buffer these events for further local processing, to process the events (including signing, data enrichment, custom processing), and sending out events to the central Event Logging Server. The Agent should only do the required minimal processing before an event is stored into the local buffer, to keep the listener waiting as little as possible. And the Agent should work offline as long as the buffer technology supports to collect events locally, and allows events and containers to continue to be collected while the needed backend services are temporarily unavailable. The temporary amount of unavailable time would approximately be up to eight hours, but it is only an estimate, not a fix limit.
-
Receiver part - to get events from the listeners until they reach the local buffer.
-
Processing part - to process each event from the local buffer.
The two parts will be described in the following sections in more details.