Running probes

When running a probe, you can specify properties in a properties file or options at the command line to configure settings for the probe.

A probe has default values for each property. In an unedited properties file, all properties are listed with their default values, commented out with a hash symbol (#) at the beginning of the line.

You can edit the properties file before running the probe, or while the probe is running. If you edit the properties file while the probe is running, the changes that you make take effect the next time you start the probe. You can edit probe property values using a text editor. To override a default value, you must change the setting in the properties file and then remove the hash symbol.

If you change a property setting on the command line when starting a probe, this overrides both the default value and the setting in the properties file. To simplify the command that you type to run the probe, add as many properties as possible to the properties file instead of using the command-line options.

When running a probe, you must also set up your rules file to define how the probe should process event data. You can edit the rules file before running the probe, or while the probe is running. If you edit the rules file while the probe is running, you must force the probe to re-read the rules file, for the changes to take effect. You can edit the rules file using a text editor.