Administration Guide › Integrations and Connectors › How to Create an Integration › Set localsyslog Configurations

Set localsyslog Configurations

You can control data access settings for integrations using the LocalSyslog log sensor to gather events. You can use the CA-provided default settings for most event collection purposes, but you can alter these settings for custom integrations.

To set localsyslog configurations

1. Open the integration wizard, select the LocalSyslog log sensor type, and advance to the Default Configurations step.
2. Set or edit the following configuration values for the targeted event source:
   • Syslog NG Server

     Defines, using True or False, whether the target server is a Syslog NG Server.

   • Syslog conf File Path

     Defines the /etc/syslog.conf file where the events you want to receive are logged.

   • UpdateAnchorRate

     Defines the threshold, in events, at which an anchor value is created. If event processing is interrupted, the agent refers to the latest anchor to begin reprocessing. Setting a lower anchor rate reduces the chance of lost events, but affects performance because the anchor value is created more often. Setting a high anchor rate increases workload, because many events would be reprocessed in the event of a processing interruption.

     Default: 1000

   • Read from beginning

     Controls whether the agent begins reading the file from the beginning if event processing is interrupted. If the check box is not selected, the agent resumes reading events using the anchor rate. If the check box is selected, the sensor reads the log file from the beginning when you deploy a connector. Depending on the size of the database and the rate of event generation, the CA Enterprise Log Manager log sensor can take some time to synchronize with real-time events.