Cluster Settings

Cluster settings control correlator behavior and are the same for all nodes. A configured value is replicated across the entire cluster.

Overriding Settings

By default, all parameters use their built-in values.

To specify a custom parameter value:

1. Click Override Setting
2. In Select Setting, select the required parameter. Its current default value is displayed next to its name
3. Enter the parameter value
4. Click Add to apply the value, or Cancel to close the form without changes

The parameter appears in a separate table of overridden settings. Resetting a parameter in this table restores its built-in value.

When a Value Takes Effect

The Restart column in the tables below shows how a parameter takes effect:

• no - the value is applied to the running cluster as soon as it is saved
• yes - the value is saved and replicated, but nodes keep running with the previous value until the smrtc service is restarted on each of them

Durations are written as <integer><unit> (ms, s, m, h, d), and sizes as <integer><unit> with binary multipliers (b, kb, mb, gb, tb). Fractional values are not supported.

Event Ingestion

Parameter	Description	Default	Restart
ingest.queue_size	In-memory ingest queue capacity, in events	1000000	yes
ingest.warmup_mode	Ingestion behavior while the node warms up: block rejects events, accept admits them	block	yes
ingest.dedupe_ttl	How long a forwarded event identifier is stored for duplicate suppression	600s	no
ingest.dedupe_max_entries	Maximum number of identifiers in the duplicate table	1000000	yes
ingest.event_sample_size	Number of event samples stored for each alias; 0 disables sampling, and the maximum is 1000	10	no

Cluster Coordination

Parameter	Description	Default	Restart
cluster.heartbeat	Interval between node heartbeat messages	3s	yes
cluster.peer_timeout	Timeout after which a node is considered unavailable; must exceed cluster.heartbeat	30s	yes
cluster.lease	Ownership lease duration used for cluster coordination	30s	yes

Data Retention

Parameter	Description	Default	Restart
retention.fires	Firing retention period	30d	no
retention.processed_sources	How long processed source statistics survive after the last event	30d	no

Important

Both retention periods must be whole multiples of a day: a value such as 36h is rejected.

Negative Filter

Parameter	Description	Default	Restart
negative_filter.enabled	Enables the negative filter	true	yes
negative_filter.budget	Filter memory budget; at least 1mb	256mb	yes
negative_filter.pending_spill	Volume of in-flight pending writes held in memory before they spill to disk; at least 1mb	32mb	yes

Time Model

Parameter	Description	Default	Restart
time_model.max_skew_fwd	How far into the future an event timestamp may run before it is clamped to receipt time	300s	no
time_model.max_lag_back_floor	Floor on how far back an event timestamp may lag; the effective bound is the greater of the rule window and this value	3600s	no
time_model.retention_grace_floor	Minimum grace added to a rule window before its correlation state is reaped	30s	no
time_model.retention_grace_ceil	Maximum such grace; must not be below time_model.retention_grace_floor	300s	no

Correlation

Parameter	Description	Default	Restart
correlation.max_partials_per_rule	Limit on concurrent incomplete imperative chains per rule	4096	no
correlation.reserved_step_pool	Slots reserved for advancing an existing chain instead of starting a new one	512	no
correlation.global_partial_ceiling	Node-wide limit on incomplete chains across all rules	1000000	no
correlation.max_aggregation_set_per_group	Limit on the distinct values a dc or values metric tracks per group	100000	no

Search Anywhere Framework Connection

Parameter	Description	Default	Restart
smart_monitor.use_tls	Uses TLS when dispatching firings to Search Anywhere Framework	true	no
smart_monitor.tls_insecure_skip_verify	Skips Search Anywhere Framework certificate verification	false	no
smart_monitor.dispatch_concurrency	Number of in-flight firing dispatch requests; allowed range is 4 to 1024	128	no

Important

smart_monitor.tls_insecure_skip_verify disables Search Anywhere Framework certificate authenticity verification.