# o6h-memory-guard 1.0.2 -- whitespace-separated, no shell evaluation.
# Restart required for configuration changes. Duplicate scalar keys are errors.
ACTION_MODE dry-run

PRE_SECONDS 3
PRESSURE_SECONDS 10
CRITICAL_SECONDS 2
RECOVERY_SECONDS 15
TERM_GRACE_SECONDS 5
NORMAL_SCAN_SECONDS 5
SCAN_BUDGET_MS 200
COOLDOWN_SECONDS 10
MAX_VICTIMS_EPISODE 4
MAX_VICTIMS_MINUTE 4
MIN_RSS_KIB 65536
LOG_MAX_MIB 10
LOG_KEEP 5

# Explicit additional protected processes: exact pr_fname (max 15 characters).
# The global zone, zone init, essential names, missing/unknown UUIDs and all
# zones without an allow rule are ALWAYS excluded. See README.
protect_process sshd
protect_process postgres
protect_process mysqld
protect_process mariadbd
protect_process redis-server
protect_process zabbix_agentd
# protect_pid 12345

# Inventory supplied by the operator, from vmadm list (outside the daemon).
# Add REAL UUIDs and aliases. No active allow rules are shipped.
# Grammar: zone <lowercase-UUID> <safe-alias-without-spaces> <allow|protect|observe>
# allow: eligible in simulations, and in armed only when both arming gates open.
# protect / observe / absent: never eligible for signals, including floor.
# Examples (replace the entire UUID; these are comments, not authorizations):
# zone YOUR-REAL-WEB-ZONE-UUID web5 allow
# zone YOUR-REAL-DB-ZONE-UUID database protect
# zone YOUR-REAL-MONITOR-ZONE-UUID monitoring protect