Settings reference
Where each setting lives and what it changes. The app’s general settings (shortcut, AI service, text around your selection) are in Install and set up; the values to choose for the model are in Requirements and settings.
In the app
Settings has three tabs: General (the AI service and how Verbiqo behaves), Extensions (your systems, while reading them is on) and Licence (status, device ID, import and remove).
| Setting | Where | What it changes | Default |
|---|---|---|---|
| Let Verbiqo read databases and other systems | Settings | Shows the Extensions tab and the /pg, /mysql, /mssql, /redis, /es, /k8s, /prom, /splunk and /security commands. | On |
| Forecast history | Settings › Extensions | How many days of history capacity forecasts read: 1 to 90. Longer shows weekly cycles; each day is more points to read from the metrics source. | 14 days |
| Trusted CA | Settings, below Endpoint | A CA certificate every connection trusts, added to the system’s: the AI service, databases, clusters, Prometheus and Splunk. Set it when your AI service uses your organization’s own certificate. Verbiqo reads the file where it is and does not copy it, so keep it there. It must be PEM text, starting -----BEGIN CERTIFICATE-----; one file can hold several CAs. See Encrypted connections. | None |
| Context window | Settings | How much text the model can hold. Blank asks the model server; set it when the server does not report one, or long evidence is trimmed to fit 4,096 tokens. 32,768 for questions about your systems. More | Ask the model |
| Timeout (ms) | Settings | How long to wait for the model, 1,000 to 300,000. For a Prometheus question, also the limit for the whole investigation: 300000 for root-cause questions. More | 30000 |
| Temperature | Settings | How much answers vary between runs, 0 to 2 (Anthropic 0 to 1). Blank uses the model server’s default. More | Blank; 0.2 recommended |
In an organization, some settings may show Managed by your administrator, and a signed policy may allow only some systems and features. Administrators: What you can control.
In each connection
Set under Extensions…; the steps are in How it works. Passwords, tokens and API keys go to the Keychain or Windows Credential Manager, never to a file.
| System | Settings |
|---|---|
| PostgreSQL | Name, host, port, database, user, password, and TLS. One connection reaches every database on the server. |
| MySQL | Name, host, port, schema (optional), user, password, and TLS. Save one per server in a replica set or cluster. |
| SQL Server | Name, host, port or instance name, database (optional), user, password; encryption (Optional, Mandatory, Strict), Trust server certificate, host name in certificate, CA certificate. Save one per replica in an availability group. |
| Redis and Valkey | Name, host, port, user (optional: the password alone signs in as default), password, and TLS with its CA, client certificate and key. |
| Elasticsearch and OpenSearch | Name, URL, sign-in (API key, user and password, or none), CA certificate, client certificate and key, Verification (Full, Certificate, None), and the log indices that security hunts may search. |
| Kubernetes | Name; a kubeconfig context, or a server URL with its CA, a service-account token and Verification; namespaces to keep to (optional); whether container logs may be read. |
| Prometheus or Thanos | Name, backend, URL, token; the index of what it watches, and technologies to refresh; optionally an embedding service for the semantic index. |
| Splunk | Name, management URL (port 8089), directory login or token. |
TLS in a connection
Each system offers the TLS choices its own tools use. The one place they are all explained, with what each mode checks, is Encrypted connections. In short:
| System | Command-line flags | Default |
|---|---|---|
| PostgreSQL | --ssl-mode disable|prefer|require|verify-ca|verify-full, --ssl-ca, --ssl-cert, --ssl-key, --ssl-key-passphrase-env VAR or --ssl-key-passphrase-stdin | require (prefer in 0.1.25 and earlier) |
| MySQL | --ssl-mode DISABLED|PREFERRED|REQUIRED|VERIFY_CA|VERIFY_IDENTITY, then the same certificate and passphrase flags | REQUIRED (PREFERRED in 0.1.25 and earlier) |
| Redis and Valkey | --ssl-mode disable|require|verify-ca|verify-full (no prefer), --ssl-ca, --ssl-cert, --ssl-key | disable |
| SQL Server | --encrypt optional|mandatory|strict, --trust-server-certificate, --host-name-in-certificate NAME, --ssl-ca | mandatory, trusting the server’s certificate |
| Elasticsearch and OpenSearch | --verification full|certificate|none, --ca, --cert, --key (--no-verify is a legacy alias for --verification none) | full |
| Kubernetes (token connections) | --ca, --verification full|certificate|none | full |
Require as the new-connection default is an unreleased 0.1.26 change. The current 0.1.25 download starts on Prefer. Existing explicit choices remain unchanged, and older saved connections with no mode keep Prefer. Require enforces encryption; Verify full also verifies the certificate and host name, and is recommended for production.
The insecure tick on a PostgreSQL or MySQL form is --ssl-mode require; it disables server-identity verification. In verification modes, a CA file left out means the system’s CAs plus Trusted CA.
How long live samples run
For right now questions, Verbiqo watches the system for a few seconds. Set these in a terminal (or in the environment the app starts from) to watch longer or shorter:
| Variable | For | Default | Range |
|---|---|---|---|
VERBIQO_PG_SAMPLE_SECONDS | PostgreSQL session sample | 10 | 3–30 |
VERBIQO_MYSQL_SAMPLE_SECONDS | MySQL session and lock sample (falls back to the PostgreSQL value) | 10 | 3–30 |
VERBIQO_MSSQL_SAMPLE_SECONDS | SQL Server request and blocking sample | 10 | 3–30 |
VERBIQO_REDIS_SAMPLE_SECONDS | Redis counter sample | 10 | 3–30 |
VERBIQO_ES_SAMPLE_SECONDS | Elasticsearch and OpenSearch node counters | 5 | 2–30 |
Capacity and history
| Variable | What it changes | Default |
|---|---|---|
VERBIQO_CAPACITY_HISTORY_DAYS | Days of history for capacity forecasts, 1 to 90. The same as Forecast history in the app; the variable wins in a terminal. | 14 |
Questions about what happened keep their own 7-day window. Every read from a metrics source stays within its query cost and time-range limits.
In a terminal
| Variable | What it changes |
|---|---|
VERBIQO_TIME_ZONE | The time zone Splunk questions read times of day and days in, such as UTC or Europe/London. Without it, this computer’s zone. |
VERBIQO_TLS_CA | A CA file every database and cluster connection trusts, as Trusted CA does in the app. A terminal also trusts the app’s Trusted CA and the computer’s trust store by itself; VERBIQO_SYSTEM_CA=off leaves the trust store out. |
VERBIQO_SYSTEM_CA | off: the terminal leaves the computer’s trust store out and trusts only Node’s own certificates and the Trusted CA. |
VERBIQO_API_KEY | The AI service’s key for that shell. Without it, the key saved in the app; on a Mac, the first time, macOS asks whether the terminal may read it: choose Always Allow. |
VERBIQO_METRIC_EMBEDDING_URL, VERBIQO_METRIC_EMBEDDING_MODEL, VERBIQO_METRIC_EMBEDDING_API_KEY | The Prometheus semantic index’s embedding service for that shell. Without them, the app’s Semantic index settings and key. See Embedding service requirements. |
VERBIQO_PROMETHEUS_INDEX_MAX_MB | The most disk the local Prometheus index may take, in MB (64 or more). Without it, it grows while 2 GB of disk stays free. See Large estates. |
VERBIQO_LICENSE_PATH | A licence file to use instead of the one imported in the app. |
VERBIQO_EXTENSIONS | off turns every connected system off for that command. |
VERBIQO_PROVIDER, VERBIQO_MODEL, VERBIQO_ENDPOINT_URL | The AI service for that command, as --provider, --model and --endpoint do. See Command line tool. |
VERBIQO_CONTEXT_TOKENS | The model’s context window, as Context window does in the app. |
VERBIQO_TIMEOUT_MS | How long to wait for the model, in milliseconds, as Timeout (ms) does in the app. |
VERBIQO_TEMPERATURE | The temperature sent to the model, as Temperature does in the app. |
VERBIQO_MODEL_THINKING | on lets a Qwen3 model reason before it answers. By default Verbiqo asks it not to, which keeps each step to seconds. See Reasoning models. |
VERBIQO_EXTENSION_LIMITS | Caps on how hard Verbiqo works each system, as JSON, for one command: {"k8s":{"queriesPerQuestion":20}}. The same object the managed setting extensionLimits takes; the lower of the two wins. See Protect your systems. |
VERBIQO_K8S_MAP_TTL | How long the names Verbiqo reads from a Kubernetes cluster (namespaces, workloads, services) are kept before being read again, in seconds: 0 to 86400, default 600. |
VERBIQO_PG_SAMPLE_SECONDS, VERBIQO_MYSQL_SAMPLE_SECONDS, VERBIQO_MSSQL_SAMPLE_SECONDS, VERBIQO_REDIS_SAMPLE_SECONDS, VERBIQO_ES_SAMPLE_SECONDS | How long a live sample runs: above. |
VERBIQO_ACCESS_LOG | Where the access record is written instead of its usual file. off turns it off, unless the organization requires it. |
VERBIQO_AUDIT_FORWARD | Where the access record is sent on, as JSON: a syslog URL, a Splunk HTTP Event Collector, or both. The same value as the managed setting auditForward. See Send it to your SIEM. |
VERBIQO_AUDIT_REQUIRED | 1: Verbiqo reads nothing it cannot record first. The same as the managed setting auditRequired. |
Limits Verbiqo keeps
| Limit | Value |
|---|---|
| Statements, commands or requests the model may add per question | 6 for PostgreSQL, MySQL, SQL Server, Redis, Elasticsearch and OpenSearch; 8 for Kubernetes; after Verbiqo’s own checks. |
| Other databases read per question | Up to 10 on one PostgreSQL server. |
| Other cluster nodes read per question | Up to 5 for PostgreSQL. |
| Machines read for Elasticsearch node cost | Up to 8 hosts. |
| Kubernetes objects read per question | 500 a page, at most 5,000 of a kind (3,000 events and replica sets), three requests at a time. |
| Systems attached at once | 3. |
On the servers
Settings on the systems themselves decide what Verbiqo can see. Ask what should I enable? with a system attached for a list marked ready or not, or read: