jcoffey-dev
3827d10e6e
-time-spread spreads generated records' timestamps uniformly at random across [now-spread, now] instead of all landing at ~now, for building a demo/exploration dataset with a real time axis (0, the default, preserves the original all-at-now volume-benchmark behavior). -include-fatal adds a low-frequency FATAL severity to the mix, off by default so the volume benchmark's existing severity distribution is unchanged unless asked for.
hack
Local developer tooling that isn't part of any shipped component — scripts
you run against your own machine/dev stack, not code that ends up in a
container image (except dev-certs' output, which mounts into the
ingest container).
Not one of the top-level directories in the original monorepo scaffold —
added because dev-only mTLS cert generation didn't have a natural home in
/deploy (real deployment manifests), /transport, or any other existing
component. /hack is the conventional name for this in a lot of larger Go
monorepos (Kubernetes among them).
dev-certs/— generates a throwaway CA + server/client cert pair for local mTLS between the agent and ingest. See/docs/phase-0-runbook.mdfor when to run it.windows-fixture/— sends synthetic Windows Event Log-shaped records directly toingest, bypassing the real Windows agent. Tests whether the pipeline handles Windows-shaped data; doesn't test the realEvtSubscribe/ETW integration, which needs actual Windows. See/docs/phase-1-runbook.md.