/usr/bin/tempo

Usage of /usr/bin/tempo:
  -auth.enabled
    	Set to true to enable auth (deprecated: use multitenancy.enabled)
  -backend-scheduler.provider.work.compaction.block-retention duration
    	Duration to keep blocks/traces. (default 336h0m0s)
  -backend-scheduler.provider.work.compaction.compaction-window duration
    	Maximum time window across which to compact blocks. (default 1h0m0s)
  -backend-scheduler.provider.work.compaction.max-block-bytes uint
    	Maximum size of a compacted block. (default 107374182400)
  -backend-scheduler.provider.work.compaction.max-objects-per-block int
    	Maximum number of traces in a compacted block. (default 6000000)
  -backend-scheduler.provider.work.max-compaction-level int
    	Maximum compaction level to include in compaction jobs. 0 means no limit.
  -backend-scheduler.provider.work.max-input-blocks int
    	Maximum number of blocks to compact in a single job. (default 4)
  -backend-scheduler.provider.work.min-cycle-interval duration
    	Minimum time between tenant prioritization cycles to prevent excessive CPU usage when no work is available. (default 30s)
  -backend-scheduler.provider.work.min-input-blocks int
    	Minimum number of blocks to compact in a single job. (default 2)
  -backend-scheduler.provider.workbackend-scheduler.compaction-provider.measure-interval duration
    	Interval at which to metric tenant blocklist (default 1m0s)
  -backend-scheduler.provider.workbackend-scheduler.max-jobs-per-tenant int
    	Maximum number of jobs to run per tenant before moving on to the next tenant (default 1000)
  -backend-scheduler.provider.workbackend-scheduler.redaction-provider.max-rescan-generations int
    	Maximum number of rescan generations before giving up and requiring operator resubmission (default 5)
  -backend-scheduler.provider.workbackend-scheduler.redaction-provider.poll-interval duration
    	Interval at which to check for pending redaction jobs when the queue is empty (default 2s)
  -backend-scheduler.provider.workbackend-scheduler.redaction-provider.rescan-delay duration
    	How long to wait before rescanning for output blocks from compaction jobs active at submission time (default 5m0s)
  -backend-scheduler.provider.workbackend-scheduler.retention-interval duration
    	Interval at which to perform tenant retention (default 1h0m0s)
  -backend-scheduler.workdead-job-timeout duration
    	Time after which a job is considered dead and marked as failed (default 24h0m0s)
  -backend-scheduler.workprune-age duration
    	Age at which to prune completed jobs (default 1h0m0s)
  -backend-schedulerbackend-scheduler.backend-flush-interval duration
    	Interval at which to flush the work cache to the backend storage (default 1m0s)
  -backend-schedulerbackend-scheduler.job-timeout duration
    	Internal duration to wait for a job before telling the worker to try again (default 15s)
  -backend-schedulerbackend-scheduler.local-work-path string
    	Path to store local work cache. (default "/var/tempo")
  -backend-schedulerbackend-scheduler.maintenance-interval duration
    	Interval at which to perform scheduler maintenance tasks (default 1m0s)
  -backend-worker.backoff-max-period duration
    	Maximum delay when backing off. (default 1m0s)
  -backend-worker.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -backend-worker.backoff-retries int
    	Number of times to backoff and retry before failing.
  -backend-worker.compaction.block-retention duration
    	Duration to keep blocks/traces. (default 336h0m0s)
  -backend-worker.compaction.compaction-window duration
    	Maximum time window across which to compact blocks. (default 1h0m0s)
  -backend-worker.compaction.max-block-bytes uint
    	Maximum size of a compacted block. (default 107374182400)
  -backend-worker.compaction.max-objects-per-block int
    	Maximum number of traces in a compacted block. (default 6000000)
  -backend-worker.finish-on-shutdown-timeout duration
    	Timeout for finishing the current job before shutting down the worker. (default 30s)
  -block-builder.assigned-partitions value
    	List of partitions assigned to this block builder.
  -block-builder.block.max-block-bytes uint
    	Maximum size of a block. (default 20971520)
  -block-builder.consume-cycle-duration duration
    	Interval between consumption cycles. (default 5m0s)
  -block-builder.instance-id string
    	Instance id. (default "localhost")
  -block-builder.max-bytes-per-cycle uint
    	Maximum number of bytes that can be consumed in a single cycle. 0 to disable (default 5000000000)
  -block-builder.partitions-per-instance int
    	Number of partitions assigned to this block builder.
  -block-builder.wal.path string
    	Path at which store WAL blocks. (default "/var/tempo/block-builder/traces")
  -block-profile-threshold int
    	Override default block profiling threshold.
  -config.enable-legacy-overrides
    	Enable the deprecated legacy overrides format. This is disabled by default and will be removed in a future release.
  -config.expand-env value
    	Whether to expand environment variables in config file
  -config.file value
    	Configuration file to load
  -config.per-user-override-config string
    	File name of per-user Overrides.
  -config.per-user-override-period value
    	Period with this to reload the Overrides. (default 10s)
  -config.verify value
    	Verify configuration and exit
  -config.verify-errors-only value
    	Fail -config.verify only on hard errors, not configuration warnings
  -distributor.ingestion-burst-size-bytes int
    	Per-user ingestion burst size in bytes. Should be set to the expected size (in bytes) of a single push request. (default 30000000)
  -distributor.ingestion-rate-limit-bytes int
    	Per-user ingestion rate limit in bytes per second. (default 30000000)
  -distributor.log-discarded-spans.enabled
    	Enable to log every discarded span to help debug ingestion or calculate span error distributions using the logs.
  -distributor.log-discarded-spans.filter-by-status-error
    	Enable to filter out spans without status error.
  -distributor.log-discarded-spans.include-attributes
    	Enable to include span attributes in the logs.
  -distributor.log-received-spans.enabled
    	Enable to log every received span to help debug ingestion or calculate span error distributions using the logs.
  -distributor.log-received-spans.filter-by-status-error
    	Enable to filter out spans without status error.
  -distributor.log-received-spans.include-attributes
    	Enable to include span attributes in the logs.
  -distributor.rate-limit-strategy string
    	Whether the various ingestion rate limits should be applied individually to each distributor instance (local), or evenly shared across the cluster (global). (default "local")
  -enable-go-runtime-metrics
    	Set to true to enable all Go runtime metrics
  -generator.address string
    	The Kafka backend address. (default "localhost:9092")
  -generator.auto-create-topic-default-partitions int
    	When auto-creation of Kafka topic is enabled and this value is positive, Kafka's num.partitions configuration option is set on Kafka brokers with this value when Tempo component that uses Kafka starts. This configuration option specifies the default number of partitions that the Kafka broker uses for auto-created topics. Note that this is a Kafka-cluster wide setting, and applies to any auto-created topic. If the setting of num.partitions fails, Tempo proceeds anyways, but auto-created topics could have an incorrect number of partitions. (default 1000)
  -generator.auto-create-topic-enabled
    	Enable auto-creation of Kafka topic if it doesn't exist. (default true)
  -generator.client-id string
    	The Kafka client ID.
  -generator.client-rack string
    	The rack identifier for this Kafka client. Corresponds to the Kafka client.rack setting and enables fetching from the closest replica (KIP-392). Set this to the instance's availability zone to reduce cross-zone Kafka traffic.
  -generator.consumer-group string
    	The consumer group used by the consumer to track the last consumed offset. The consumer group must be different for each ingester. If the configured consumer group contains the '<partition>' placeholder, it is replaced with the actual partition ID owned by the ingester. When empty (recommended), Tempo uses the ingester instance ID to guarantee uniqueness.
  -generator.consumer-group-offset-commit-interval duration
    	How frequently a consumer should commit the consumed offset to Kafka. The last committed offset is used at startup to continue the consumption from where it was left. (default 1s)
  -generator.consumer_group_lag_metric_update_interval duration
    	How often the lag metric is updated. Set to 0 to disable metric calculation and export  (default 1m0s)
  -generator.dial-timeout duration
    	The maximum time allowed to open a connection to a Kafka broker. (default 2s)
  -generator.disable-kafka-telemetry
    	Disable KIP-714 Kafka client metrics
  -generator.instance-availability-zone string
    	Define Availability Zone in which this instance is running.
  -generator.instance-id string
    	Instance id. (default "localhost")
  -generator.last-produced-offset-retry-timeout duration
    	How long to retry a failed request to get the last produced offset. (default 10s)
  -generator.leave-consumer-group-on-shutdown
    	If true, send LeaveGroup to Kafka on shutdown for immediate partition reassignment. Default false; set to true for Deployment rollouts where pod names change on each restart.
  -generator.max-consumer-lag-at-startup duration
    	The guaranteed maximum lag before a consumer is considered to have caught up reading from a partition at startup, becomes ACTIVE in the hash ring and passes the readiness check. Set both -generator.target-consumer-lag-at-startup and -generator.max-consumer-lag-at-startup to 0 to disable waiting for maximum consumer lag being honored at startup. (default 15s)
  -generator.producer-compression string
    	Compression codec used by the Kafka producer. Supported values: none, gzip, snappy, lz4, zstd. If not set, the Kafka client's default codec preference is used.
  -generator.producer-max-buffered-bytes int
    	The maximum size of (uncompressed) buffered and unacknowledged produced records sent to Kafka. The produce request fails once this limit is reached. This limit is per Kafka client. 0 to disable the limit. (default 1073741824)
  -generator.producer-max-record-size-bytes int
    	The maximum size of a Kafka record data that should be generated by the producer. An incoming write request larger than this size is split into multiple Kafka records. We strongly recommend to not change this setting unless for testing purposes. (default 15983616)
  -generator.sasl-mechanism value
    	The SASL mechanism used to authenticate to Kafka. Supported values: PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, OAUTHBEARER, AWS_MSK_IAM. For backwards-compatibility, PLAIN with no username nor password disables SASL. (default PLAIN)
  -generator.sasl-msk-iam-access-key value
    	The AWS access key ID to authenticate to Kafka using SASL AWS_MSK_IAM. Consider generator.sasl-msk-iam-file-path instead.
  -generator.sasl-msk-iam-file-path string
    	Path to a file containing AWS credentials to authenticate to Kafka using SASL AWS_MSK_IAM. Mutually exclusive with generator.sasl-msk-iam-http-socket-path. The file is read anew on every reauthentication, so it can be updated with fresh credentials. The file must be in JSON format, adhering to this JSON schema: {"type": "object", "required": ["AccessKey", "SecretKey"], "properties": {"AccessKey": {"type": "string"}, "SecretKey": {"type": "string"}, "SessionToken": {"type": "string"}, "UserAgent": {"type": "string"}}}
  -generator.sasl-msk-iam-http-socket-path string
    	Path to a Unix domain socket to fetch AWS credentials from via HTTP. Mutually exclusive with generator.sasl-msk-iam-file-path. On every authentication or reauthentication, an HTTP GET / request is made to the socket and the response body is read as JSON. The JSON schema is the same as for generator.sasl-msk-iam-file-path.
  -generator.sasl-msk-iam-http-socket-timeout duration
    	Timeout for requesting AWS credentials from the HTTP socket. Effective when generator.sasl-msk-iam-http-socket-path is set. (default 10s)
  -generator.sasl-msk-iam-secret-key value
    	The AWS secret access key to authenticate to Kafka using SASL AWS_MSK_IAM. Consider generator.sasl-msk-iam-file-path instead.
  -generator.sasl-msk-iam-session-token value
    	Optional AWS session token to authenticate to Kafka using SASL AWS_MSK_IAM.
  -generator.sasl-msk-iam-user-agent string
    	Optional user agent to use when authenticating to Kafka using SASL AWS_MSK_IAM.
  -generator.sasl-oauthbearer-extensions value
    	Optional additional OAuth extensions to include when authenticating to Kafka using SASL OAUTHBEARER as a JSON object. (default {})
  -generator.sasl-oauthbearer-file-path string
    	Path to a file containing an OAuth token to authenticate to Kafka. Mutually exclusive with generator.sasl-oauthbearer-http-socket-path. The file is read anew on every reauthentication, so it can be updated with fresh tokens. The file must be in JSON format, adhering to this JSON schema: {"type": "object", "required": ["token"], "properties": {"token": {"type": "string"}, "zid": {"type": "string"}, "extensions": {"type": "object", "additionalProperties": {"type": "string"}}}}
  -generator.sasl-oauthbearer-http-socket-path string
    	Path to a Unix domain socket to fetch an OAuth token from via HTTP. Mutually exclusive with generator.sasl-oauthbearer-file-path. On every authentication or reauthentication, an HTTP GET / request is made to the socket and the response body is read as JSON. The JSON schema is the same as for generator.sasl-oauthbearer-file-path.
  -generator.sasl-oauthbearer-http-socket-timeout duration
    	Timeout for requesting the token from the HTTP socket. Effective when generator.sasl-oauthbearer-http-socket-path is set. (default 10s)
  -generator.sasl-oauthbearer-token value
    	The OAuth token to use to authenticate to Kafka. Consider generator.sasl-oauthbearer-file-path instead.
  -generator.sasl-oauthbearer-zid string
    	Optional authorization ID to use when authenticating to Kafka using SASL OAUTHBEARER.
  -generator.sasl-password value
    	The password used to authenticate the username to Kafka using SASL. To enable SASL, configure both the username and password.
  -generator.sasl-username string
    	The username used to authenticate to Kafka using SASL. To enable SASL, configure both the username and password.
  -generator.skip-stale-backlog-on-startup
    	If true, on startup seek partitions forward to now-metrics_ingestion_time_range_slack instead of replaying from the committed offset, skipping backlog the slack would drop. Requires Kafka ingest.
  -generator.target-consumer-lag-at-startup duration
    	The best-effort maximum lag a consumer tries to achieve at startup. Set both -generator.target-consumer-lag-at-startup and -generator.max-consumer-lag-at-startup to 0 to disable waiting for maximum consumer lag being honored at startup. (default 2s)
  -generator.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -generator.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -generator.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -generator.tls-enabled
    	Enable TLS for the Kafka client connection.
  -generator.tls-insecure-skip-verify
    	Skip validating server certificate.
  -generator.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -generator.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -generator.tls-server-name string
    	Override the expected name on the server certificate.
  -generator.topic string
    	The Kafka topic name.
  -generator.write-timeout duration
    	How long to wait for an incoming write request to be successfully committed to the Kafka backend. (default 10s)
  -generatorconsul.acl-token value
    	ACL Token used to interact with Consul.
  -generatorconsul.cas-retry-delay duration
    	Maximum duration to wait before retrying a Compare And Swap (CAS) operation. (default 1s)
  -generatorconsul.client-timeout duration
    	HTTP timeout when talking to Consul (default 20s)
  -generatorconsul.consistent-reads
    	Enable consistent reads to Consul.
  -generatorconsul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -generatorconsul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -generatorconsul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -generatoretcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -generatoretcd.endpoints value
    	The etcd endpoints to connect to.
  -generatoretcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -generatoretcd.password value
    	Etcd password.
  -generatoretcd.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -generatoretcd.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -generatoretcd.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -generatoretcd.tls-enabled
    	Enable TLS.
  -generatoretcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -generatoretcd.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -generatoretcd.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -generatoretcd.tls-server-name string
    	Override the expected name on the server certificate.
  -generatoretcd.username string
    	Etcd username.
  -generatormulti.mirror-enabled
    	Mirror writes to the secondary store.
  -generatormulti.mirror-timeout duration
    	Timeout for storing a value to the secondary store. (default 2s)
  -generatormulti.primary string
    	Primary backend storage used by multi-client.
  -generatormulti.secondary string
    	Secondary backend storage used by multi-client.
  -generatorprefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -generatorstore string
    	Backend storage to use for the ring. Supported values are: consul, etcd, inmemory, memberlist, multi. (default "consul")
  -health
    	Run a health check against the /ready endpoint and exit
  -health.url string
    	URL to check when running health check (default "http://localhost:3200/ready")
  -http-api-prefix string
    	String prefix for all http api endpoints.
  -ingest.address string
    	The Kafka backend address. (default "localhost:9092")
  -ingest.auto-create-topic-default-partitions int
    	When auto-creation of Kafka topic is enabled and this value is positive, Kafka's num.partitions configuration option is set on Kafka brokers with this value when Tempo component that uses Kafka starts. This configuration option specifies the default number of partitions that the Kafka broker uses for auto-created topics. Note that this is a Kafka-cluster wide setting, and applies to any auto-created topic. If the setting of num.partitions fails, Tempo proceeds anyways, but auto-created topics could have an incorrect number of partitions. (default 1000)
  -ingest.auto-create-topic-enabled
    	Enable auto-creation of Kafka topic if it doesn't exist. (default true)
  -ingest.client-id string
    	The Kafka client ID.
  -ingest.client-rack string
    	The rack identifier for this Kafka client. Corresponds to the Kafka client.rack setting and enables fetching from the closest replica (KIP-392). Set this to the instance's availability zone to reduce cross-zone Kafka traffic.
  -ingest.consumer-group string
    	The consumer group used by the consumer to track the last consumed offset. The consumer group must be different for each ingester. If the configured consumer group contains the '<partition>' placeholder, it is replaced with the actual partition ID owned by the ingester. When empty (recommended), Tempo uses the ingester instance ID to guarantee uniqueness.
  -ingest.consumer-group-offset-commit-interval duration
    	How frequently a consumer should commit the consumed offset to Kafka. The last committed offset is used at startup to continue the consumption from where it was left. (default 1s)
  -ingest.consumer_group_lag_metric_update_interval duration
    	How often the lag metric is updated. Set to 0 to disable metric calculation and export  (default 1m0s)
  -ingest.dial-timeout duration
    	The maximum time allowed to open a connection to a Kafka broker. (default 2s)
  -ingest.disable-kafka-telemetry
    	Disable KIP-714 Kafka client metrics
  -ingest.last-produced-offset-retry-timeout duration
    	How long to retry a failed request to get the last produced offset. (default 10s)
  -ingest.max-consumer-lag-at-startup duration
    	The guaranteed maximum lag before a consumer is considered to have caught up reading from a partition at startup, becomes ACTIVE in the hash ring and passes the readiness check. Set both -ingest.target-consumer-lag-at-startup and -ingest.max-consumer-lag-at-startup to 0 to disable waiting for maximum consumer lag being honored at startup. (default 15s)
  -ingest.producer-compression string
    	Compression codec used by the Kafka producer. Supported values: none, gzip, snappy, lz4, zstd. If not set, the Kafka client's default codec preference is used.
  -ingest.producer-max-buffered-bytes int
    	The maximum size of (uncompressed) buffered and unacknowledged produced records sent to Kafka. The produce request fails once this limit is reached. This limit is per Kafka client. 0 to disable the limit. (default 1073741824)
  -ingest.producer-max-record-size-bytes int
    	The maximum size of a Kafka record data that should be generated by the producer. An incoming write request larger than this size is split into multiple Kafka records. We strongly recommend to not change this setting unless for testing purposes. (default 15983616)
  -ingest.sasl-mechanism value
    	The SASL mechanism used to authenticate to Kafka. Supported values: PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, OAUTHBEARER, AWS_MSK_IAM. For backwards-compatibility, PLAIN with no username nor password disables SASL. (default PLAIN)
  -ingest.sasl-msk-iam-access-key value
    	The AWS access key ID to authenticate to Kafka using SASL AWS_MSK_IAM. Consider ingest.sasl-msk-iam-file-path instead.
  -ingest.sasl-msk-iam-file-path string
    	Path to a file containing AWS credentials to authenticate to Kafka using SASL AWS_MSK_IAM. Mutually exclusive with ingest.sasl-msk-iam-http-socket-path. The file is read anew on every reauthentication, so it can be updated with fresh credentials. The file must be in JSON format, adhering to this JSON schema: {"type": "object", "required": ["AccessKey", "SecretKey"], "properties": {"AccessKey": {"type": "string"}, "SecretKey": {"type": "string"}, "SessionToken": {"type": "string"}, "UserAgent": {"type": "string"}}}
  -ingest.sasl-msk-iam-http-socket-path string
    	Path to a Unix domain socket to fetch AWS credentials from via HTTP. Mutually exclusive with ingest.sasl-msk-iam-file-path. On every authentication or reauthentication, an HTTP GET / request is made to the socket and the response body is read as JSON. The JSON schema is the same as for ingest.sasl-msk-iam-file-path.
  -ingest.sasl-msk-iam-http-socket-timeout duration
    	Timeout for requesting AWS credentials from the HTTP socket. Effective when ingest.sasl-msk-iam-http-socket-path is set. (default 10s)
  -ingest.sasl-msk-iam-secret-key value
    	The AWS secret access key to authenticate to Kafka using SASL AWS_MSK_IAM. Consider ingest.sasl-msk-iam-file-path instead.
  -ingest.sasl-msk-iam-session-token value
    	Optional AWS session token to authenticate to Kafka using SASL AWS_MSK_IAM.
  -ingest.sasl-msk-iam-user-agent string
    	Optional user agent to use when authenticating to Kafka using SASL AWS_MSK_IAM.
  -ingest.sasl-oauthbearer-extensions value
    	Optional additional OAuth extensions to include when authenticating to Kafka using SASL OAUTHBEARER as a JSON object. (default {})
  -ingest.sasl-oauthbearer-file-path string
    	Path to a file containing an OAuth token to authenticate to Kafka. Mutually exclusive with ingest.sasl-oauthbearer-http-socket-path. The file is read anew on every reauthentication, so it can be updated with fresh tokens. The file must be in JSON format, adhering to this JSON schema: {"type": "object", "required": ["token"], "properties": {"token": {"type": "string"}, "zid": {"type": "string"}, "extensions": {"type": "object", "additionalProperties": {"type": "string"}}}}
  -ingest.sasl-oauthbearer-http-socket-path string
    	Path to a Unix domain socket to fetch an OAuth token from via HTTP. Mutually exclusive with ingest.sasl-oauthbearer-file-path. On every authentication or reauthentication, an HTTP GET / request is made to the socket and the response body is read as JSON. The JSON schema is the same as for ingest.sasl-oauthbearer-file-path.
  -ingest.sasl-oauthbearer-http-socket-timeout duration
    	Timeout for requesting the token from the HTTP socket. Effective when ingest.sasl-oauthbearer-http-socket-path is set. (default 10s)
  -ingest.sasl-oauthbearer-token value
    	The OAuth token to use to authenticate to Kafka. Consider ingest.sasl-oauthbearer-file-path instead.
  -ingest.sasl-oauthbearer-zid string
    	Optional authorization ID to use when authenticating to Kafka using SASL OAUTHBEARER.
  -ingest.sasl-password value
    	The password used to authenticate the username to Kafka using SASL. To enable SASL, configure both the username and password.
  -ingest.sasl-username string
    	The username used to authenticate to Kafka using SASL. To enable SASL, configure both the username and password.
  -ingest.target-consumer-lag-at-startup duration
    	The best-effort maximum lag a consumer tries to achieve at startup. Set both -ingest.target-consumer-lag-at-startup and -ingest.max-consumer-lag-at-startup to 0 to disable waiting for maximum consumer lag being honored at startup. (default 2s)
  -ingest.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -ingest.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -ingest.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -ingest.tls-enabled
    	Enable TLS for the Kafka client connection.
  -ingest.tls-insecure-skip-verify
    	Skip validating server certificate.
  -ingest.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -ingest.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -ingest.tls-server-name string
    	Override the expected name on the server certificate.
  -ingest.topic string
    	The Kafka topic name.
  -ingest.write-timeout duration
    	How long to wait for an incoming write request to be successfully committed to the Kafka backend. (default 10s)
  -ingester.max-bytes-per-trace int
    	Maximum size of a trace in bytes.  0 to disable. (default 5000000)
  -ingester.max-global-traces-per-user int
    	Maximum number of active traces per user, across the cluster. 0 to disable.
  -ingester.max-traces-per-user int
    	Maximum number of active traces per user, per ingester. 0 to disable. (default 10000)
  -live-store.complete-block-timeout duration
    	Duration to keep blocks in the live store after they have been flushed. (default 20m0s)
  -live-store.concurrent-blocks uint
    	Number of concurrent blocks to query for metrics. (default 10)
  -live-store.instance-availability-zone string
    	Define Availability Zone in which this instance is running.
  -live-store.metrics.time-overlap-cutoff float
    	Time overlap cutoff ratio for metrics queries (0.0-1.0). (default 0.2)
  -live-store.partition-ring.consul.acl-token value
    	ACL Token used to interact with Consul.
  -live-store.partition-ring.consul.cas-retry-delay duration
    	Maximum duration to wait before retrying a Compare And Swap (CAS) operation. (default 1s)
  -live-store.partition-ring.consul.client-timeout duration
    	HTTP timeout when talking to Consul (default 20s)
  -live-store.partition-ring.consul.consistent-reads
    	Enable consistent reads to Consul.
  -live-store.partition-ring.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -live-store.partition-ring.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -live-store.partition-ring.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -live-store.partition-ring.delete-inactive-partition-after duration
    	How long to wait before an INACTIVE partition is eligible for deletion. The partition is deleted only if it has been in INACTIVE state for at least the configured duration and it has no owners registered. A value of 0 disables partitions deletion. (default 13h0m0s)
  -live-store.partition-ring.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -live-store.partition-ring.etcd.endpoints value
    	The etcd endpoints to connect to.
  -live-store.partition-ring.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -live-store.partition-ring.etcd.password value
    	Etcd password.
  -live-store.partition-ring.etcd.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -live-store.partition-ring.etcd.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -live-store.partition-ring.etcd.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -live-store.partition-ring.etcd.tls-enabled
    	Enable TLS.
  -live-store.partition-ring.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -live-store.partition-ring.etcd.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -live-store.partition-ring.etcd.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -live-store.partition-ring.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -live-store.partition-ring.etcd.username string
    	Etcd username.
  -live-store.partition-ring.min-partition-owners-count int
    	Minimum number of owners to wait before a PENDING partition gets switched to ACTIVE. (default 1)
  -live-store.partition-ring.min-partition-owners-duration duration
    	How long the minimum number of owners are enforced before a PENDING partition gets switched to ACTIVE. (default 10s)
  -live-store.partition-ring.multi.mirror-enabled
    	Mirror writes to the secondary store.
  -live-store.partition-ring.multi.mirror-timeout duration
    	Timeout for storing a value to the secondary store. (default 2s)
  -live-store.partition-ring.multi.primary string
    	Primary backend storage used by multi-client.
  -live-store.partition-ring.multi.secondary string
    	Secondary backend storage used by multi-client.
  -live-store.partition-ring.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -live-store.partition-ring.store string
    	Backend storage to use for the ring. Supported values are: consul, etcd, inmemory, memberlist, multi. (default "memberlist")
  -live-store.readiness-max-wait duration
    	Maximum time to wait for catching up at startup. Only used if readiness-target-lag > 0. (default 30m0s)
  -live-store.readiness-target-lag duration
    	Target lag threshold before live-store is ready. 0 disables waiting (backward compatible).
  -live-store.remove-owner-on-shutdown
    	Remove partition owner from the ring on shutdown. (default true)
  -live-store.shutdown_marker_dir string
    	Path to the shutdown marker directory. (default "/var/tempo/live-store/shutdown-marker")
  -live-store.wal.path string
    	Path at which store WAL blocks. (default "/var/tempo/live-store/traces")
  -live-storeconsul.acl-token value
    	ACL Token used to interact with Consul.
  -live-storeconsul.cas-retry-delay duration
    	Maximum duration to wait before retrying a Compare And Swap (CAS) operation. (default 1s)
  -live-storeconsul.client-timeout duration
    	HTTP timeout when talking to Consul (default 20s)
  -live-storeconsul.consistent-reads
    	Enable consistent reads to Consul.
  -live-storeconsul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -live-storeconsul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -live-storeconsul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -live-storeetcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -live-storeetcd.endpoints value
    	The etcd endpoints to connect to.
  -live-storeetcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -live-storeetcd.password value
    	Etcd password.
  -live-storeetcd.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -live-storeetcd.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -live-storeetcd.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -live-storeetcd.tls-enabled
    	Enable TLS.
  -live-storeetcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -live-storeetcd.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -live-storeetcd.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -live-storeetcd.tls-server-name string
    	Override the expected name on the server certificate.
  -live-storeetcd.username string
    	Etcd username.
  -live-storemulti.mirror-enabled
    	Mirror writes to the secondary store.
  -live-storemulti.mirror-timeout duration
    	Timeout for storing a value to the secondary store. (default 2s)
  -live-storemulti.primary string
    	Primary backend storage used by multi-client.
  -live-storemulti.secondary string
    	Secondary backend storage used by multi-client.
  -live-storeprefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -live-storestore string
    	Backend storage to use for the ring. Supported values are: consul, etcd, inmemory, memberlist, multi. (default "consul")
  -log.level value
    	Only log messages with the given severity or above. Valid levels: [debug, info, warn, error] (default info)
  -memberlist.bind-port int
    	Port for memberlist to communicate on (default 7946)
  -memberlist.host-port value
    	Host port to connect to memberlist cluster.
  -memberlist.message-history-buffer-bytes int

  -metrics-generator.native-histogram-bucket-factor float
    	The growth factor between buckets for native histograms. (default 1.1)
  -metrics-generator.native-histogram-max-bucket-number value
    	The maximum number of buckets for native histograms. (default 100)
  -metrics-generator.native-histogram-min-reset-duration duration
    	The minimum duration before a native histogram can be reset. (default 15m0s)
  -multitenancy.enabled
    	Set to true to enable multitenancy.
  -mutex-profile-fraction int
    	Override default mutex profiling fraction.
  -querier.frontend-address string
    	Address of query frontend service, in host:port format.
  -querier.max-blocks-per-tag-values-query int
    	Maximum number of blocks to query for a tag-values query. 0 to disable.
  -querier.max-bytes-per-tag-values-query int
    	Maximum size of response for a tag-values query. Used mainly to limit large the number of values associated with a particular tag (default 1000000)
  -querier.max-condition-groups-per-tag-query int
    	Maximum number of OR-expanded condition groups allowed in a tag search query. Queries that expand beyond this limit will be rejected. (default 100)
  -query-frontend.mcp-server.enabled
    	Set to true to enable the MCP server
  -reporting.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -reporting.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -reporting.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -reporting.enabled
    	Enable anonymous usage reporting. (default true)
  -server.grpc-listen-port int
    	gRPC server listen port. (default 9095)
  -server.http-listen-port int
    	HTTP server listen port. (default 3200)
  -shutdown-delay duration
    	How long to wait between SIGTERM and shutdown. After receiving SIGTERM, Tempo will report not-ready status via /ready endpoint.
  -span-profiling
    	Set to true to enable span profiling (pyroscope pprof labels on OTel spans).
  -storage.trace.azure.container_name string
    	Azure container name to store blocks in.
  -storage.trace.azure.endpoint string
    	Azure endpoint to push blocks to. (default "blob.core.windows.net")
  -storage.trace.azure.max_buffers int
    	Number of simultaneous uploads. (default 4)
  -storage.trace.azure.prefix string
    	Azure container prefix to store blocks in.
  -storage.trace.azure.storage_account_key value
    	Azure storage access key.
  -storage.trace.azure.storage_account_name string
    	Azure storage account name.
  -storage.trace.backend string
    	Trace backend (s3, azure, gcs, local)
  -storage.trace.block.v2-bloom-filter-false-positive float
    	Bloom Filter False Positive. (default 0.01)
  -storage.trace.block.v2-bloom-filter-shard-size-bytes int
    	Bloom Filter Shard Size in bytes. (default 102400)
  -storage.trace.blocklist_poll duration
    	Period at which to run the maintenance cycle. (default 5m0s)
  -storage.trace.gcs.bucket string
    	gcs bucket to store traces in.
  -storage.trace.gcs.list_blocks_concurrency int
    	number of concurrent list calls to make to backend (default 3)
  -storage.trace.gcs.max_retries int
    	number of times to retry failed compaction/retention operations (default 3)
  -storage.trace.gcs.prefix string
    	gcs bucket prefix to store traces in.
  -storage.trace.local.path string
    	path to store traces at.
  -storage.trace.pool.max-workers int
    	Workers in the worker pool. (default 400)
  -storage.trace.pool.queue-depth int
    	Work item queue depth. (default 20000)
  -storage.trace.s3.access_key string
    	s3 access key.
  -storage.trace.s3.bucket string
    	s3 bucket to store blocks in.
  -storage.trace.s3.endpoint string
    	s3 endpoint to push blocks to.
  -storage.trace.s3.list_blocks_concurrency int
    	number of concurrent list calls to make to backend (default 3)
  -storage.trace.s3.prefix string
    	s3 root directory to store blocks in.
  -storage.trace.s3.secret_key value
    	s3 secret key.
  -storage.trace.s3.session_token value
    	s3 session token.
  -storage.trace.s3.sse.encryption-key value
    	SSE-C Encryption Key used for object encryption.
  -storage.trace.s3.sse.kms-encryption-context string
    	KMS Encryption Context used for object encryption. It expects JSON formatted string.
  -storage.trace.s3.sse.kms-key-id string
    	KMS Key ID used to encrypt objects in S3
  -storage.trace.s3.sse.type string
    	Enable AWS Server Side Encryption. Supported values: SSE-KMS, SSE-S3, SSE-C.
  -storage.trace.s3.tls_min_version string
    	minimum version of TLS to use when connecting to s3. (default "VersionTLS12")
  -storage.trace.wal.path string
    	Path at which store WAL blocks. (default "/var/tempo/wal")
  -target string
    	target module (default "all")
  -version
    	Print this builds version information