Node Configuration

Node configuration parameters are specified in /app/smrtc/config/smrtc.yml. The installer populates the values during installation. See Installation. The smrtc process reads them once at startup.

Important

Changing node configuration parameters requires restarting the smrtc service and must be performed separately on each node. These parameters cannot be viewed or edited in the Search Anywhere Framework interface.

Each parameter can be specified either as a key in smrtc.yml or as an environment variable. Both methods are equivalent.

The installer writes only the required minimum to smrtc.yml: roles, port, TLS, keystore, cluster name and addresses, the data root directory, and logging. All other parameters use their built-in defaults and are present in the template as comments.

Value Formats

Some parameters are written as a string with a unit rather than as a plain number:

Type	Format	Examples
Size	<integer><unit> with binary multipliers: b, kb, mb, gb, tb	64mb, 256mb, 1gb
Duration	<integer><unit>: ms, s, m, h, d	250ms, 2s, 150ms

info

Fractional values are not supported: write 1.5s as 1500ms. A size of 0 is also rejected because it carries no unit; the auto literal exists for automatic detection.

Network and Ports

Parameter	Path in smrtc.yml	Description	Default
NODE_PORT	node.port	Public port for event ingestion, the management API, and /health	9919
TRANSPORT_PORT	node.transport_port	Inter-node gRPC transport port used by Raft and the entire node-to-node control plane	9910
CLUSTER_ADVERTISE_URL	node.advertise_url	Address at which other nodes and Search Anywhere Framework reach this node; an empty value is detected from the routing table	empty

Cluster

Parameter	Path in smrtc.yml	Description	Default
CLUSTER_NAME	cluster.name	Cluster name; must be the same on all nodes and match the OU field in the node certificate	smrtc_cluster
NODE_ROLES	roles (top-level list without a section)	Node roles; master indicates a metadata quorum member, while an empty value indicates a non-voting replica	empty
CLUSTER_NODES	cluster.nodes (list)	Node addresses used to join the cluster in host:port format; an empty value means the node forms a cluster by itself	empty

TLS

Parameter	Path in smrtc.yml	Description	Default
TLS_ENABLED	tls.enabled	Enables TLS and mTLS on the public and transport listeners	false
TLS_CERT_FILE	tls.cert_file	Node certificate	empty
TLS_KEY_FILE	tls.key_file	Node private key	empty
TLS_CA_CERT_FILE	tls.ca_cert_file	Certificate authority bundle used to verify peer certificates	empty

Important

When tls.enabled is true, all three paths - tls.cert_file, tls.key_file, and tls.ca_cert_file - are required. If any of them is missing, the node does not start and reports the reason in the log.

Authentication and Keystore

Parameter	Path in smrtc.yml	Description	Default
DEFAULT_ADMIN_USER	admin.user	Local administrator username; the password is stored in the keystore	admin
KEYSTORE_FILE	keystore.file	Encrypted secret file for the admin password and the Search Anywhere Framework connection password	/app/smrtc/config/keystore
KEYSTORE_PASSPHRASE	keystore.passphrase	Keystore passphrase	empty

Data Directories

DATA_DIR defines the storage root: the other five directories inherit from it by default.

Parameter	Path in smrtc.yml	Description	Default
DATA_DIR	data.dir	Root directory for node data	/app/smrtc/data
METADATA_DATA_DIR	data.metadata_dir	Metadata directory containing bbolt and the Raft log	<data.dir>/metadata
DATA_CLUSTER_DIR	data.cluster_dir	Directory for the node identity and persisted rule suppressions	<data.dir>/cluster
TELEMETRY_DATA_DIR	data.telemetry_dir	Directory for processed source statistics	<data.dir>/telemetry
FIRES_DATA_DIR	data.fires_dir	Firing log directory	<data.dir>/fires
ACTIVE_LISTS_DATA_DIR	data.active_lists_dir	Active lists directory	<data.dir>/active-lists
CONTENT_DIR	content.dir	Directory of content packs imported at startup on the first cluster node; an empty value disables the import	empty

Engine

Parameter	Path in smrtc.yml	Description	Default
WORKER_COUNT	engine.worker_count	Worker pool size and number of internal correlation shards; 0 uses the number of CPU cores	0
STATE_MAX_GROUPS	engine.state_max_groups	Node-wide limit on rule and group correlation states, divided equally across shards; 0 means unlimited	8000000
ACTIVE_LISTS_BLOCK_CACHE	engine.active_lists_block_cache	Read cache for active lists	64mb
ACTIVE_LISTS_AUTOFILL_WORKERS	engine.active_lists_autofill_workers	Number of write-behind flusher threads for automatic list population	4
ACTIVE_LISTS_AUTOFILL_CHUNK	engine.active_lists_autofill_chunk	Number of mutations applied per pass; allowed range is 1 to 1000	512
ACTIVE_LISTS_AUTOFILL_FLUSH_INTERVAL	engine.active_lists_autofill_flush_interval	Flush period for buffered automatic population writes	150ms
ACTIVE_LISTS_AUTOFILL_BUFFER_MAX	engine.active_lists_autofill_buffer_max	Buffer limit for automatic population, after which new writes are dropped; 0 means unlimited, otherwise the value must be at least 1000	200000

Event Ingestion

Parameter	Path in smrtc.yml	Description	Default
INGEST_DEDUPE_PEAK_EPS	ingest.dedupe_peak_eps	Assumed peak rate of events forwarded between nodes; sets the lower bound of the duplicate table	100000

Memory Circuit Breaker

Parameter	Path in smrtc.yml	Description	Default
INGEST_MEMORY_CB_ENABLED	memory_circuit_breaker.enabled	Memory circuit breaker for event ingestion	true
INGEST_MEMORY_CB_LIMIT	memory_circuit_breaker.limit	Memory budget; auto detects it from GOMEMLIMIT and then from the cgroup limit, otherwise specify a size of at least 256mb	auto
INGEST_MEMORY_CB_SOFT_PCT	memory_circuit_breaker.soft_pct	Soft limit threshold as a percentage of the limit	85
INGEST_MEMORY_CB_HARD_PCT	memory_circuit_breaker.hard_pct	Threshold at which event ingestion is rejected, as a percentage of the limit	92
INGEST_MEMORY_CB_RELEASE_PCT	memory_circuit_breaker.release_pct	Limit release threshold as a percentage of the limit	75
INGEST_MEMORY_CB_SAMPLE	memory_circuit_breaker.sample	Memory sampling period; at least 50ms	250ms
INGEST_MEMORY_CB_FORCE_GC	memory_circuit_breaker.force_gc	Forces a garbage collection cycle when the circuit breaker trips	true
INGEST_MEMORY_CB_GC_COOLDOWN	memory_circuit_breaker.gc_cooldown	Minimum interval between forced garbage collection cycles; at least 100ms	2s

Important

The three thresholds must increase strictly: release_pct < soft_pct < hard_pct. Violating this order is a startup error rather than a reason to adjust values automatically: the node does not start and reports the reason in the log.

Logging

Parameter	Path in smrtc.yml	Description	Default
LOG_FILE	log.file	Log file; an empty value sends output to the standard error stream, which systemd forwards to journald	empty
LOG_MAX_SIZE	log.max_size	Log file size before rotation; must be a whole number	100mb
LOG_MAX_BACKUPS	log.max_backups	Number of retained log archives; 0 retains all of them	14
LOG_COMPRESS	log.compress	Compresses log archives	true