How to configure the event processor to stream the data from the remote log collector
Originally Published: 2016-05-05
Article Number
Applies To
RSA Product/Service Type: Log Collector
RSA Version/Condition: 10.4.x,10.5.x,10.6.x
Platform: CentOS
O/S Version: EL6
Issue
Resolution
2) Under the Remote Log Collector properties select Add and then paste the text: ### name=GlobalStream type=LogDecoder ### within the parameter section and click Send.
3) Navigate to event-processors/GlobalStream/destinations/logdecoder/consumer/processors/tcpconnector/config/connector/channel/tcp.
4) On the properties section modify the fields as below -
ssl - Default is false, If you want to use ssl change it to true
port - Default is 514 for tcp, you cahnge it in the range 1-65535
failover_list - Please use the format [{\”address\”:\”<IPADDRESS>\”,\”port\”:<514>, \”ssl\”: <false>}]
address - Default is 10.112.11.19, its the tcp address where data will be sent.
5) Finally Right-Click on event-processor/GlobalStream then click properties and select restart under the properties section.
6) Now the Source Remote Log Collector is configured to stream events/log to the destination Global RLC.
