Cribl Source & Destination Configuration 3 — Questions and Answers
Question 1: What is the primary purpose of enabling a Persistent Queue (PQ) on a Cribl destination?
- Cache events in memory for faster delivery
- Store events on disk when the destination is unavailable (Correct answer)
- Deduplicate events before sending
- Compress events to reduce bandwidth
Correct answer: Store events on disk when the destination is unavailable
Persistent Queue stores events to disk so they can be delivered later if the destination is temporarily unavailable, preventing data loss.
Question 2: In which scenario would you configure a pre-processing pipeline directly on a Cribl source?
- To route events to multiple destinations simultaneously
- To apply transformations before events enter the main routing table (Correct answer)
- To authenticate the source connection
- To compress data before writing to disk
Correct answer: To apply transformations before events enter the main routing table
A pre-processing pipeline on a source applies transformations or filtering to events before they are passed to the main routing and pipeline system.
Question 3: What controls when the Cribl S3 destination creates a new object (file) in the target bucket?
- The max file size and flush period settings (Correct answer)
- The S3 bucket ACL policy
- The IAM role permissions
- The object key prefix only
Correct answer: The max file size and flush period settings
The max file size and flush period settings together determine when Cribl closes the current object and starts a new one in S3.
Question 4: What is the default behavior when a Cribl destination's Persistent Queue reaches its configured maximum disk size?
- PQ automatically expands beyond the limit
- New incoming events are blocked or dropped based on the backpressure behavior setting (Correct answer)
- Events are routed to a secondary destination automatically
- PQ purges the oldest events to make room
Correct answer: New incoming events are blocked or dropped based on the backpressure behavior setting
When the PQ is full, Cribl applies backpressure to block or drop new events depending on the configured backpressure behavior setting.
Question 5: Which setting in a Cribl HTTP destination controls how many events are grouped together in a single outbound HTTP request?
- Max connections
- Flush period
- Batch size (Correct answer)
- Concurrency limit
Correct answer: Batch size
The batch size setting determines how many events Cribl groups into a single payload before sending one HTTP request to the destination.
Question 6: When configuring the Elasticsearch destination in Cribl, which default authentication method is used to connect?
- OAuth 2.0
- API Key
- Username and password (Basic auth) (Correct answer)
- Kerberos
Correct answer: Username and password (Basic auth)
The Elasticsearch destination defaults to Basic authentication using a username and password to connect to the Elasticsearch cluster.
Question 7: What metadata field does Cribl automatically attach to events from a TCP source to record the sender's network address and port?
- __sourceIp
- __srcIpPort (Correct answer)
- __inputId
- __tcpSender
Correct answer: __srcIpPort
Cribl populates the __srcIpPort field with the IP address and port of the client that sent the event over the TCP connection.
Cribl Source & Destination Configuration 3
What is the primary purpose of enabling a Persistent Queue (PQ) on a Cribl destination?