To add a syslog TCP source service, use the Syslog TCP source service type.
You can configure the following properties for the Syslog TCP source service type:
- Entity Name
- Name of the Syslog TCP source service. Maximum length is 32 characters.
- Description of the source service. Maximum length is 256 characters.
- TCP port that the source application uses to connect to the Syslog TCP source service.
- Line feed character sequence that marks the end of a message in the TCP data stream.
- Maximum Event Size
- Maximum length of data that the source service can read at a time, in bytes. Default is 8192. Minimum value is 1. Maximum value is 51200.
- Retry on Failure
Indicates that the source service should try to open or read from the source if the operation fails the first time.
- Number of Retries
The number of times the source service should retry to open or read from the source.
- Delay between Retries
- Time in milliseconds between successive retries.
- Persist Data
- Persist the data from the source locally so that the source service can continue to process data even if the target is not available.
- Persistence Options
- You can configure the following persistence options:
- batchSizeInBytes. The batch size of the events in bytes after which the data is written to the persistent store. Specify a value of 0 if you want to write the data to the persistent store immediately. Default is 262144 bytes.
- flushInterval. The interval in milliseconds after which the source services writes data to the persistent store. Default is 5000 milliseconds.
- maxDataFiles. The maximum number of data files that the source service can keep in the persistent store. After the number of files exceed this number, a rollover occurs. Default is 10.
- maxDataFileSize. The maximum size of each data file in bytes. When the file reaches the specified size, a file rollover occurs. Default is 1073741824.
- maxQueueSizeInBytes. The maximum size of data that is unsent or has not received acknowledgment in bytes that can be stored in the persistent store. If the specified size is exceeded, the source service does not read data from the source. If you specify a value of 0, the unsent data can be as much as the value of
maxDataFileSize. Default is unlimited size.
- The statistics that you can choose to monitor for the Syslog TCP source. You can select the following statistics:
- Bytes Sent. Number of bytes sent by the source service.
- Events Sent. Number of events sent by the source service.
- Events to be Sent. Number of events that the source service is yet to send.
- Events not Delivered. Number of events that the source service did not deliver.
- Send Rate (Per Sec). Number of bytes sent every second.
- Events Dropped. The number of events dropped by the source service while processing the source data.
- Concurrent Connections. The number of Syslog TCP clients currently connected to the source service.
- Maximum Concurrent Clients. The maximum number of Syslog TCP clients connected to the source service since the time the source service is up.