Director

VirtualMetric Director™ is the orchestration and data processing engine of the DataStream platform. The vmetric-director executable runs the service itself, and also provides the command-line tools for configuration, validation, pipeline testing, data generation, device discovery, and diagnostics.

Synopsis

vmetric-director [OPTIONS]

Help output is mode-dependent. vmetric-director -h lists only the options valid outside a mode; a mode's own options are listed alongside it, e.g. vmetric-director -mode pipeline -h.

General Options

These options are valid outside a mode.

Option	Default	Description
`-compare-version`	-	Compare with specified version
`-config`	-	Apply a registration string and write the local configuration file
`-config-path`	-	Path to a single configuration file (skips recursive configuration folder scan)
`-example`	-	Show configuration examples
`-export`	-	Export destination or format. With `-license`, the report format (`json`, `csv`, `md`, `license`); with `-mode cert`, the output directory
`-license`	-	Show license information
`-license-info`	-	Show active airgapped license file
`-path`	-	Installation path when used with `-service install`; configuration path in pipeline and validation modes
`-pfx2pem`	-	Convert PFX certificate to PEM format
`-validate`	-	Validate configuration files. Equivalent to `-mode validate`
`-version`	-	Display version information

The argument to -config is a base64-encoded string of semicolon-separated fields — fleet instance, director ID, and token — issued when the Director is registered. It is decoded and written to the local configuration file.

Service Management

Option	Default	Description
`-agentless`	-	Run without installing as a service
`-background`	-	Run in background mode
`-info`	-	Display service information
`-service`	-	Service operation (`install`, `uninstall`, `start`, `stop`, `restart`)
`-service-name`	-	Custom service name for installation
`-stop`	-	Stop the running process
`-vpc`	-	Display product code

-service and -agentless are mutually exclusive, as are -service and -background. Combining -service install with -path relocates the installation to the given path.

Modes

A mode is selected with -mode <name>, or with the equivalent shorthand option. Mode names are matched case-insensitively. Passing more than one mode option in a single invocation is not supported.

Mode	Shorthand	Purpose
`director`	`-director`	Run the orchestration service. This is the default
`supervisor`	`-supervisor`	Run the service watchdog
`console`	`-console`	Tail the live console output
`pipeline`	`-pipeline`	Execute a pipeline against sample data
`generator`	`-generator`	Generate test data
`validate`	`-validate`	Validate the configuration files
`sentinel`	`-sentinel`	Run network discovery and monitoring
`snmpwalk`	`-snmpwalk`	Perform SNMP device discovery
`dcr`	`-dcr`	Generate a Data Collection Rule
`ocsf`	`-ocsf`	Generate an OCSF schema
`cert`	`-cert`	Show the agent interface TLS certificate
`capture-profile`	`-capture-profile`	Capture a diagnostic profile bundle
`update`	`-update`	Run the update process
`restart`	`-restart`	Restart the service via a detached child

The director, supervisor, validate, update, and restart modes take no options of their own. The remainder are detailed below.

Console

vmetric-director -mode console [OPTIONS]

Option	Default	Description
`-agent-id`	`0`	Device ID of the managed agent whose console to tail; `0` tails the Director
`-debug-level`	`3`	Set debug verbosity level (1-5)
`-filter`	-	Filter console output by keywords

The debug level is a threshold: entries at or below the given level are shown. The levels are 1 Error, 2 Warning, 3 Information, 4 Debug, and 5 Verbose.

Pipeline

vmetric-director -mode pipeline -name [pipeline_name] [OPTIONS]

Option	Default	Description
`-definition_id`	-	Pipeline definition identifier
`-diff`	-	Show differences between actual and expected output
`-expected`	-	Expected output file for validation
`-extended`	-	Show extended processing information
`-input`	-	Input data file or JSON string
`-json`	-	Export pipeline results as JSON
`-name`	-	Pipeline name for processing
`-output`	-	Output file for processed data
`-output-style`	`basic`	Pipeline output display style (`basic`, `extended`, `jsonl`)
`-visualize`	-	Display pipeline processing visualization

This mode also accepts -path for the configuration path, and -filter and -validate from the general options.

Generator

vmetric-director -mode generator [OPTIONS]

Option	Default	Description
`-address`	`127.0.0.1:514`	Target address for generated data
`-count`	`1000`	Number of messages to generate
`-duration`	`300`	Total generation duration (seconds)
`-filepath`	-	File path for file-based operations
`-interval`	`1`	Interval between messages (seconds)
`-message`	`VirtualMetric Test Message`	Message content
`-now`	-	Generate messages immediately
`-protocol`	`syslog`	Protocol for data generation (`syslog`, `tcp`, `udp`, `http`, `netflow`, `vmf`)
`-severity`	`Error`	Syslog severity level (`Alert`, `Critical`, `Error`, `Warning`, `Notice`, `Information`, `Debug`)

The following simulate the supported log streaming protocols:

Syslog:

vmetric-director -mode generator -protocol syslog -address 127.0.0.1:514 -severity Error -message "Test Message" -count 1000 -interval 1 -duration 300

TCP:

vmetric-director -mode generator -protocol tcp -address 127.0.0.1:9000 -message "Test Message" -count 1000 -interval 1 -duration 300

UDP:

vmetric-director -mode generator -protocol udp -address 127.0.0.1:514 -message "Test Message" -count 1000 -interval 1 -duration 300

HTTP:

vmetric-director -mode generator -protocol http -address http://127.0.0.1:8080/logs -message "Test Message" -count 1000 -interval 1 -duration 300

Netflow:

vmetric-director -mode generator -protocol netflow -address 127.0.0.1:2055 -count 1000 -interval 1 -duration 300

VMF:

vmetric-director -mode generator -protocol vmf -filepath input.json -message "Test Message" -count 1000 -interval 1 -duration 300

Sentinel

vmetric-director -mode sentinel [OPTIONS]

Option	Default	Description
`-autodiscovery`	-	Enable automatic network discovery
`-auxiliary`	-	Use auxiliary discovery tables
`-basic`	-	Use basic discovery tables

SNMP Walk

vmetric-director -mode snmpwalk -snmp-deviceid [device_id] -snmp-host [host] [OPTIONS]

Option	Default	Description
`-snmp-community`	-	SNMP community string
`-snmp-deviceid`	-	SNMP device identifier
`-snmp-host`	-	Target SNMP host address
`-snmp-oid`	`.1.3`	Starting OID for SNMP walk
`-snmp-port`	`161`	SNMP port number
`-snmp-version`	`2c`	SNMP version (`1`, `2c`, `3`)

-snmp-community applies to SNMP v1 and v2c only.

DCR

vmetric-director -mode dcr [OPTIONS]

Option	Default	Description
`-dcr-description`	-	Description of the Data Collection Rule
`-dcr-name`	-	Name of the Data Collection Rule
`-dcr-schema`	-	Schema file, or directory of schema files, of the tables (Avro, Parquet, Log Analytics table JSON, JSON column list or Kusto column list)
`-table-names`	-	Comma-separated list of table names to include

Without -dcr-name, -table-names or -dcr-schema, -mode dcr writes the predefined DCRs, as before. With any of them, it writes three files to dcr/ and prints the warnings and the deploy command:

<name>.json, the DCR resource;
<name>.template.json, the ARM template;
<name>.bicep, the Bicep template.

When -dcr-schema is a directory:

It matches .json, .avsc and .csl files to the named tables by file name, ignoring case, Custom- and _CL.
With no -table-names, each schema file is one table.
A table named after its file must be a valid table name: a letter, then letters, digits and underscores, at most 63 characters with _CL included. Otherwise the error names the file to rename.

A table with no schema file keeps its compiled model. Several tables need -dcr-name.

OCSF

vmetric-director -mode ocsf [OPTIONS]

Option	Default	Description
`-max-depth`	`-1`	Maximum depth for OCSF profile generation
`-profiles`	-	Comma-separated list of OCSF profiles to include
`-schema-name`	-	Name of the OCSF schema
`-schema-version`	-	Version of the OCSF schema

Certificate

vmetric-director -mode cert [-export directory]

Option	Default	Description
`-export`	-	Directory to write `cert.pem` and `ca.pem` to

Without -export, the certificate is printed. Auto-generated certificates only.

Capture Profile

vmetric-director -mode capture-profile [OPTIONS]

Option	Default	Description
`-profile-duration`	`60`	Capture duration in seconds (20-300)
`-profile-output`	-	Output directory or `.zip` path for the bundle; defaults to the current directory

Collects CPU, memory, and goroutine profiles from the running service into a single zip file.

Agent Installation

vmetric-director -install-command -device-id [device_id] -address [host:port] [OPTIONS]

Option	Default	Description
`-address`	`127.0.0.1:514`	Address the agent connects back to. Shared with the generator mode; the default is rejected here, so supply it explicitly
`-device-id`	-	Device ID the installation command is issued for
`-device-token`	-	Device token to embed in the installation command, when one is attached
`-device-type`	`linux`	Agent platform (`linux`, `windows`)
`-install-command`	-	Print the agent installation command for a device

The printed command carries the Director address, token, and device identity to the target host. See Agent for how the agent consumes it.

Option Index

Every option, with the section documenting it. Defaults and descriptions are given there, not here.

Option	Documented under
`-address`	Generator, Agent Installation
`-agent-id`	Console
`-agentless`	Service Management
`-autodiscovery`	Sentinel
`-auxiliary`	Sentinel
`-background`	Service Management
`-basic`	Sentinel
`-capture-profile`	Modes
`-cert`	Modes
`-compare-version`	General Options
`-config`	General Options
`-config-path`	General Options
`-console`	Modes
`-count`	Generator
`-dcr`	Modes
`-dcr-description`	DCR
`-dcr-name`	DCR
`-dcr-schema`	DCR
`-debug-level`	Console
`-definition_id`	Pipeline
`-device-id`	Agent Installation
`-device-token`	Agent Installation
`-device-type`	Agent Installation
`-diff`	Pipeline
`-director`	Modes
`-duration`	Generator
`-example`	General Options
`-expected`	Pipeline
`-export`	General Options, Certificate
`-extended`	Pipeline
`-filepath`	Generator
`-filter`	Console, Pipeline
`-generator`	Modes
`-info`	Service Management
`-input`	Pipeline
`-install-command`	Agent Installation
`-interval`	Generator
`-json`	Pipeline
`-license`	General Options
`-license-info`	General Options
`-max-depth`	OCSF
`-message`	Generator
`-mode`	Modes
`-name`	Pipeline
`-now`	Generator
`-ocsf`	Modes
`-output`	Pipeline
`-output-style`	Pipeline
`-path`	General Options
`-pfx2pem`	General Options
`-pipeline`	Modes
`-profile-duration`	Capture Profile
`-profile-output`	Capture Profile
`-profiles`	OCSF
`-protocol`	Generator
`-restart`	Modes
`-schema-name`	OCSF
`-schema-version`	OCSF
`-sentinel`	Modes
`-service`	Service Management
`-service-name`	Service Management
`-severity`	Generator
`-snmp-community`	SNMP Walk
`-snmp-deviceid`	SNMP Walk
`-snmp-host`	SNMP Walk
`-snmp-oid`	SNMP Walk
`-snmp-port`	SNMP Walk
`-snmp-version`	SNMP Walk
`-snmpwalk`	Modes
`-stop`	Service Management
`-supervisor`	Modes
`-table-names`	DCR
`-update`	Modes
`-validate`	General Options
`-version`	General Options
`-visualize`	Pipeline
`-vpc`	Service Management

Synopsis​

General Options​

Service Management​

Modes​

Console​

Pipeline​

Generator​

Sentinel​

SNMP Walk​

DCR​

OCSF​

Certificate​

Capture Profile​

Agent Installation​

Option Index​