Template Discovery & Drift Management

In large-scale infrastructure, telemetry pipelines are prone to configuration drift. Individual servers are frequently modified during incident debugging or by legacy automation scripts. Template Discovery continuously analyzes the structural configurations reported by your fleet to identify drift and group similar nodes.

---

1. Auto-Discovery & Structural Hashing

When a Supervisor connects to the control plane, it transmits its current running OTel configuration file. To handle this data at scale without storing duplicate files, CollectorCtrl implements a structural hashing pipeline:

[Agent config.yaml] ---> (Strip Comments & Keys) ---> [Canonical YAML] ---> (SHA-256) ---> [Template Group]

1. Normalization: The system parses the YAML payload, stripping comments, whitespace variation, and node-specific credentials.
2. Canonical Hashing: Generates a cryptographic SHA-256 hash of the canonical structure.
3. De-duplication: Agents that report identical configuration structures are grouped under a single template hash.

---

2. Managing Configuration Drift

Config drift occurs when local changes are made directly on edge hosts, bypassing your central policies.

The Template Discovery console exposes drift by grouping your fleet:

• Baseline Groups: Large clusters of agents running identical configurations (e.g. 500 agents running template IIS Web Baseline).
• Outlier Groups: Small clusters or individual agents running unique hashes. These outliers point directly to configuration drift.
• Audit Triggers: Clicking an outlier group shows a visual diff comparing its configuration against the authorized baseline policy, highlighting unauthorized receivers or deactivated security processors.

---

3. Template Tagging & Metadata Reviews

Instead of managing hexadecimal hash strings, administrators can audit and label discovered structures:

1. Identify Unlabeled Templates: Review newly discovered configuration hashes in the Template Discovery table.
2. Review & Approve: Inspect the raw YAML structure. If the structure is correct, click Tag Template.
3. Apply Metadata: Assign a friendly name and category tags (e.g., Standard Windows Active Directory Collector, Tags: production, security-hardened).
4. Resolution: The metadata is saved in the database. CollectorCtrl then replaces the raw hash strings across the dashboard with your friendly names, providing immediate operational context.

---

4. Remediation: Force-Syncing Drifted Agents

When drifted outlier nodes are discovered, you can remediate them directly from the dashboard:

1. Select the drifted template group or outlier nodes.
2. Click Realign to Policy.
3. The control plane compiles the authorized policy configuration for those nodes, increments the version hash, and pushes it to the target Supervisors.
4. The local Supervisors overwrite the drifted local files, execute hot-reloads, and report back as Healthy and in-sync with the authorized template.