Hawk Container Edition Microagents

Hawk agent in Hawk Container Edition comprises some microagent from Hawk and some additional microagents. The Hawk agent uses these microagents to collect information and operate using that information.

Hawk Microagents

In Hawk Container Edition, the Hawk agent has the following microagents from Hawk:

Self
The Self microagent gathers version information for the local agent, the security policy in effect, and available microagents.
SysInfo
The SysInfo microagent gathers basic information on the operating system, hardware architecture, computer name and IP address of the agent container.
RuleBaseEngine
The RuleBaseEngine microagent gathers information about the rulebases and takes actions on rulebases that affect the Hawk agent.
TcpClusterStatus
The TcpClusterStatus microagent provides methods to monitor the health of the TCP transport cluster and TCP daemons.
TcpMessaging
The TCPMessaging microagent provides methods to send and receive messages by using the TCP Transport for Hawk.
Custom
The Custom microagent provides methods to run programs and scripts in Hawk Container Edition.

Additional Hawk Container Edition Microagents

In addition to the microagents from Hawk, the Hawk Container Edition software provides the following microagents for container environments.
The DockerHostMA Microagent
The DockerHostMA microagent is available on each Docker host as a part of the Hawk agent. It monitors and manages all containers running on that particular Docker host. Some of the key features of the DockerHostMA microagent are as follows:
  • The microagent communicates with the Docker host using the Docker client API. For more information about Docker client API, see Docker Client User Manual.
  • The microagent contains methods to perform the following functions:
    • Monitoring container statistics (CPU, memory, network I/O)
    • Managing containers (starting, stopping, pausing)
    • Monitoring container logs
The UniversalCollectorMicroAgent Microagent

The Universal Collector microagent enables you to monitor the log files, Docker container logs, and Hawk rulebases. You can also forward these logs and rulebase data to TIBCO LogLogic® Log Management Intelligence (LMI) or another Syslog. LogLogic® LMI is an log management solution that you can use to consume and archive all the log data. You can also implement the method to send logs to LogLogic LMI as an action in the rulebase. The microagent uses collectors and forwarders to distribute the data from different sources to the specified destinations. To forward the data, the microagent uses ULDP for LogLogic LMI and TCP/TLS syslog for other Syslog consumers.

For details about LogLogic LMI, see TIBCO LogLogic® Log Management Intelligence (LMI) documentation.

All the forwarder and collector configurations created using the UniversalCollectorMicroAgent methods are stored in a YAML file (universalcollector.yaml). This file is generated at the location set by the hma_plugin_dir environment variable. The configuration file created in a container has a short life. Thus, removing the hkce_agent container might lead to loss of forwarder and collector configurations that were stored in the universalcollector.yaml file. To avoid this issue, you must map a Docker volume to the hma_plugin_dir environment variable.

For more information about methods of these microagents, see TIBCO Hawk® Container Edition Microagent Reference Guide.