EDR Content

Format

All EDRs generated by n2svcd applications use a common EDR Format. The specific field names and values are application-specific and documented per-application.

Filenames

EDRs generated by n2svcd applications are contained in files like so:

stream1_host1.nsquared.nz_20200929215226512355_1095022.edr
stream2_host1.nsquared.nz_20200929215238998003_1095022.edr

Each filename has multiple underscore-separated parts, in order:

• The EDR stream key (stream1 and stream2 above), representing the application’s configured EDR stream key, either from its default_edr_stream_key parameter or derived otherwise from within the application logic.
• The hostname of the machine that is running n2svcd (host1.nsquared.nz above).
• The timestamp that the EDR file was opened at, including microseconds.
• The process ID of the writing process. If multiple-process service daemon is enabled, this will be the N2SVCD application. Otherwise, it will be the EDR Application.