Skip to main content

Morio client reference documentation

The Morio client bundles various agents in addition to the morio client binary. Those agents are:

The documenation for these agents is linked above. Below, we focus on the morio client binary itself.

Installation​

This reference documentation assumes you have already installed the Morio client. Refer to the Morio Client Installation Guide for details on how to install the Morio client if you havent’ done so yet.

Commands​

tip

The Morio client requires elevated privileges. In other words, you need to prefix all commands below with sudo on Linux or MacOS. On Windows, you should run these commands in a command window with elevated privileges.

We also assume the morio binary is in your path. Refer to the install guide for details.

help​

Running morio help will show you the inline help:

morio help

morio: The Morio client

This client wraps different agents that each gather one type
of observability data and ship it to a Morio broker.

Use this to manage the various agents and their configuration.

Usage:
  morio [command]

Available Commands:
  audit       Invoke the audit agent
  completion  Generate the autocompletion script for the specified shell
  fetch       Fetch client configuration
  help        Help about any command
  join        Join this client to a Morio cluster
  join-group  Join this client to an inventory group
  leave-group Remove this client from an inventory group
  logs        Invoke the logs agent
  metrics     Invoke the metrics agent
  modules     Manage modules
  pull        Pull client configuation (fetch + template)
  push        Push client configuation
  rejoin      Re-Join this client to a Morio cluster
  report      Send local system info to the Morio cluster
  reset       Reset the client configuration
  restart     Restart agents
  start       Start agents
  status      Shows agents status
  stop        Stop agents
  template    Template out the agents configuration
  unjoin      Removes this client from the currently joined cluster
  vars        Manage configuration template variables
  version     Morio client version

Flags:
  -h, --help      help for morio
  -v, --version   version for morio

Use "morio [command] --help" for more information about a command.

audit​

The morio audit command invokes the audit agent, in other words an auditbeat instance specifically configured for Morio.

You can use this to invoke the audit agent directly. For example:

morio audit help
Usage:
  auditbeat [flags]
  auditbeat [command]

Available Commands:
  export      Export current config or index template
  help        Help about any command
  keystore    Manage secrets keystore
  run         Run auditbeat
  setup       Setup index template, dashboards and ML jobs
  show        Show modules information
  test        Test config
  version     Show current version info

Flags:
  -E, --E setting=value              Configuration overwrite
  -N, --N                            Disable actual publishing for testing
  -c, --c string                     Configuration file, relative to path.config (default "auditbeat.yml")
      --cpuprofile string            Write cpu profile to file
  -d, --d string                     Enable certain debug selectors
  -e, --e                            Log to stderr and disable syslog/file output
      --environment environmentVar   set environment being ran in (default default)
  -h, --help                         help for auditbeat
      --httpprof string              Start pprof http server
      --memprofile string            Write memory profile to this file
      --path.config string           Configuration path
      --path.data string             Data path
      --path.home string             Home path
      --path.logs string             Logs path
      --plugin pluginList            Load additional plugins
      --strict.perms                 Strict permission checking on config files (default true)
  -v, --v                            Log at INFO level

Use "auditbeat [command] --help" for more information about a command.

Refer to the Auditbeat documentation for more info.

completion​

Use the morio completion command to generate an autocompletion script for the shell of your choice.

Run this command without options to see a list of supported shells:

morio completion --help
Generate the autocompletion script for morio for the specified shell.
See each sub-command's help for details on how to use the generated script.

Usage:
  morio completion [command]

Available Commands:
  bash        Generate the autocompletion script for bash
  fish        Generate the autocompletion script for fish
  powershell  Generate the autocompletion script for powershell
  zsh         Generate the autocompletion script for zsh

Flags:
  -h, --help   help for completion

Use "morio completion [command] --help" for more information about a command.
note

This is provided for convencience. There’s is no need to use autocompletion.

fetch​

Run morio fetch to load the client configuration from the Morio cluster.

Below is example output, but the exact result will depend on the client configuration.

morio fetch --help
Loads the client configuration from the Morio cluster.

Usage:
  morio fetch [flags]

Flags:
  -h, --help   help for fetch

join​

Use the morio join command to join the Morio client to a Morio cluster. You typically run this once, after installing the client.

To join a cluster, you need at minimal the hostname of a node of the cluster. Once the client has joined the cluster, it will trust the cluster’s certificates. However, when joining the cluster, the client will not trust the cluster, unless its CA is trusted by the client.

To get around the chicken-and-the-egg problem, you can pass the path to a CA certificate to trust, or if you must forego certificate chain validation with the --insecure flag.

If the Morio cluster is configured to require an invite code, you should specify that with the --invite flag.

morio join --help
Join a cluster using the provided cluster name.
Optionally provide an invitation code using the --invite flag.

Usage:
  morio join [cluster] [flags]

Flags:
      --ca-cert string   Path to a CA certificate file to trust for TLS verification
  -h, --help             help for join
      --insecure         Skip TLS certificate verification (INSECURE: exposes credentials to MITM attacks)
      --invite string    Invitation code (optional)

join-group​

Use the morio join-group command to add the Morio client to an inventory group.

This has no effect on the client itself, but will add the client to an inventory group.

morio join-group --help
This adds this local client to a (pre-existing) inventory group.

Usage:
  morio join-group [flags]

Examples:
  morio join-group webservers

Flags:
  -h, --help   help for join-group
tip

Morio’s internal inventory can be used a an Ansible inventory. Group membership will be reflected in that inventory. This command allows you to manage group membership via the client CLI. It is provided for convenience, you do not have to use this.

leave-group​

Use the morio leave-group command to remove the Morio client from an inventory group.

This has no effect on the client itself, but will remove the client from an inventory group.

morio join-group --help
This adds this local client to a (pre-existing) inventory group.

Usage:
  morio join-group [flags]

Examples:
  morio join-group webservers

Flags:
  -h, --help   help for join-group
tip

Morio’s internal inventory can be used a an Ansible inventory. Group membership will be reflected in that inventory. This command allows you to manage group membership via the client CLI. It is provided for convenience, you do not have to use this.

logs​

The morio logs command invokes the logs agent, in other words a filebeat instance specifically configured for Morio.

You can use this to invoke the logs agent directly. For example:

morio logs help
Usage:
  filebeat [flags]
  filebeat [command]

Available Commands:
  export      Export current config or index template
  generate    Generate Filebeat modules, filesets and fields.yml
  help        Help about any command
  keystore    Manage secrets keystore
  modules     Manage configured modules
  run         Run filebeat
  setup       Setup index template, dashboards and ML jobs
  test        Test config
  version     Show current version info

Flags:
  -E, --E setting=value              Configuration overwrite
  -M, --M setting=value              Module configuration overwrite
  -N, --N                            Disable actual publishing for testing
  -c, --c string                     Configuration file, relative to path.config (default "filebeat.yml")
      --cpuprofile string            Write cpu profile to file
  -d, --d string                     Enable certain debug selectors
  -e, --e                            Log to stderr and disable syslog/file output
      --environment environmentVar   set environment being ran in (default default)
  -h, --help                         help for filebeat
      --httpprof string              Start pprof http server
      --memprofile string            Write memory profile to this file
      --modules string               List of enabled modules (comma separated)
      --once                         Run filebeat only once until all harvesters reach EOF
      --path.config string           Configuration path
      --path.data string             Data path
      --path.home string             Home path
      --path.logs string             Logs path
      --plugin pluginList            Load additional plugins
      --strict.perms                 Strict permission checking on config files (default true)
  -v, --v                            Log at INFO level

Use "filebeat [command] --help" for more information about a command.

Refer to the Filebeat documentation for more info.

metrics​

The morio metrics command invokes the metrics agent, in other words a metricbeat instance specifically configured for Morio.

You can use this to invoke the metrics agent directly. For example:

morio metrics help
Usage:
  metricbeat [flags]
  metricbeat [command]

Available Commands:
  export      Export current config or index template
  help        Help about any command
  keystore    Manage secrets keystore
  modules     Manage configured modules
  run         Run metricbeat
  setup       Setup index template, dashboards and ML jobs
  test        Test config
  version     Show current version info

Flags:
  -E, --E setting=value              Configuration overwrite
  -N, --N                            Disable actual publishing for testing
  -c, --c string                     Configuration file, relative to path.config (default "metricbeat.yml")
      --cpuprofile string            Write cpu profile to file
  -d, --d string                     Enable certain debug selectors
  -e, --e                            Log to stderr and disable syslog/file output
      --environment environmentVar   set environment being ran in (default default)
  -h, --help                         help for metricbeat
      --httpprof string              Start pprof http server
      --memprofile string            Write memory profile to this file
      --path.config string           Configuration path
      --path.data string             Data path
      --path.home string             Home path
      --path.logs string             Logs path
      --plugin pluginList            Load additional plugins
      --strict.perms                 Strict permission checking on config files (default true)
      --system.hostfs string         Mount point of the host's filesystem for use in monitoring a host from within a container
  -v, --v                            Log at INFO level

Use "metricbeat [command] --help" for more information about a command.

Refer to the Metricbeat documentation for more info.

modules​

Use the morio modules command to enable or disable Morio client modules.

Use this command to enable or disable a local module, or mark a module as enabled or disabled centrally, with the remote- prefix.

morio modules --help
Manages client modules.
This allows you to manage Morio client modules which will be applied to all agents.

Usage:
  morio modules [command]

Available Commands:
  disable        Disable a local module
  disable-remote Disable a remote module
  enable         Enable a local module
  enable-remote  Enable a remote module
  info           Show local module info
  list           List local modules
  list-remote    List remote modules

Flags:
  -h, --help   help for modules

Use "morio modules [command] --help" for more information about a command.

pull​

The morio pull command combines morio fetch with morio template.

In other words, it will fetch the configuration, and template it out.

morio pull --help
Pull the client configuration from the Morio cluster.

Usage:
  morio pull [flags]

Flags:
  -h, --help   help for pull

push​

The morio push command will push the local client configuration to the cluster.

morio push --help
Push the local client configuration to the Morio cluster.

Usage:
  morio push [flags]

Flags:
  -h, --help   help for push

rejoin​

Use the morio rejoin command to re-join a client to a Morio cluster.

This command will issue a new client certificate, so you can use this to renew the client certificates.

sudo morio rejoin --help
Re-Join a cluster using the provided cluster name.
Optionally provide an invitation code using the --invite flag.

Usage:
  morio rejoin [cluster] [flags]

Flags:
      --ca-cert string   Path to a CA certificate file to trust for TLS verification
  -h, --help             help for rejoin
      --insecure         Skip TLS certificate verification (INSECURE: exposes credentials to MITM attacks)
      --invite string    Invitation code (optional)

report​

The morio report command will submit information about the local system to the Morio cluster. The information collected includes:

  • The system’s hostname
  • The number of CPU cores
  • The amount of memory
  • The installed software packages
  • The IP addresses configured on the system
  • The MAC addresses of the network interfaces on the system
note

The way the client detects the installed software depends on the operating system:

  • On Linux, we query the package manager (we support both .deb and .rpm based systems)
  • On MacOS, we query the system_profiler and also check for Homebrew and MacPorts packages
  • On Windows, we query the registry

reset​

The morio reset command allows you reset (remove) all, or certain aspects of, the Morio client configuration.

morio reset --help
The 'morio reset' command allows you to reset
all, or certain aspects of, the Morio client configuration.

Usage:
  morio reset [command]

Available Commands:
  all         Removes all local configuration
  join        Removes the cluster-specific configuration
  modules     Removes all module templates
  vars        Removes all (custom) client variables

Flags:
  -h, --help   help for reset

Use "morio reset [command] --help" for more information about a command.

restart​

The morio restart command allows you to restart one or more services that run the various Morio client agents.

morio restart --help
Restarts all beats agents, or the one you pass it

Usage:
  morio restart [flags]
  morio restart [command]

Examples:
  Restart all agents:
    morio restart

  Restart a specific agent:
    morio restart logs

Available Commands:
  audit       Restarts the audit agent (auditbeat)
  eventlogs   Restarts the eventlogs agent (winlogbeat)
  logs        Restarts the logs agent (filebeat)
  metrics     Restarts the metrics agent (metricbeat)

Flags:
  -h, --help   help for restart

Use "morio restart [command] --help" for more information about a command.
note

The eventlogs agent is only available on Windows.

start​

The morio start command allows you to start one or more services that run the various Morio client agents.

morio start --help
Starts all beats agents, or the one you pass it

Usage:
  morio start [flags]
  morio start [command]

Examples:
  Start all agents:
    morio start

  Start a specific agent:
    morio start logs

Available Commands:
  audit       Starts the audit agent (auditbeat)
  eventlogs   Starts the eventlogs agent (winlogbeat)
  logs        Starts the logs agent (filebeat)
  metrics     Starts the metrics agent (metricbeat)

Flags:
  -h, --help   help for start

Use "morio start [command] --help" for more information about a command.
note

The eventlogs agent is only available on Windows.

status​

The morio status command shows the status of one or more services that run the various Morio client agents.

morio status --help
Shows the status of all agents, or the one you pass it

Usage:
  morio status [flags]

Examples:
  Show the status of all agents:
    morio status

  Show the status of a specific agent:
    morio status logs

Flags:
  -h, --help   help for status

stop​

The morio stop command allows you to stop one or more services that run the various Morio client agents.

morio stop --help
Stops all beats agents, or the one you pass it

Usage:
  morio stop [flags]
  morio stop [command]

Examples:
  Stops all agents:
    morio stop

  Stop a specific agent:
    morio stop logs

Available Commands:
  audit       Stops the audit agent (auditbeat)
  eventlogs   Stops the eventlogs agent (winlogbeat)
  logs        Stops the logs agent (filebeat)
  metrics     Stops the metrics agent (metricbeat)

Flags:
  -h, --help   help for stop

Use "morio stop [command] --help" for more information about a command.

template​

Use the morio template command to template out the configuration.

morio template --help
Templates out the configuration for the different agents.

Usage:
  morio template [flags]

Examples:
  morio template

Flags:
  -h, --help   help for template
tip

To learn more about what this command does under the hood, refer to the Morio Client Guide.

unjoin​

Use the morio unjoin command to remove the client from the Morio cluster it is currently joined to.

sudo morio unjoin --help
This will delete the local configuration and remove this client from the currently joined cluster.

Usage:
  morio unjoin [flags]

Flags:
  -h, --help   help for unjoin

vars​

Use the morio vars command to manage the variables leveraged by the client when templating out the configuration.

sudo morio vars --help
The 'morio vars' command allows you to manage
template variables for the Morio client configuration.

The Morio client wraps various beats agents that all have their own
configuration and modules to manage. Morio ships these as templates
that take various variables (vars). This command allows you to manage
these vars.

To combine the configuration templates and your vars into an actual
configuration, run 'morio template'.

Usage:
  morio vars [command]

Available Commands:
  clear       Set a var to an empty string
  disable     Set a var to false
  enable      Set a var to true
  export      Exports vars to JSON
  get         Get the value of a var
  import      Import vars from a JSON file
  list        List all vars
  rm          Remove a (custom) variable
  set         Set the value of a var

Flags:
  -h, --help   help for vars

Use "morio vars [command] --help" for more information about a command.
tip

To learn more about the role of variables in the client configuration, refer to the Morio Client Guide.

version​

Use the morio version command to show the version of the Morio client.

morio version --help
Shows the Morio client version

Usage:
  morio version [flags]

Flags:
  -h, --help   help for version