Data-Flow Management in Streaming Analysis - Real-Time Analytics - page 118

The Syslog source then monitors all of the ports for syslog events in an
efficient way. In addition to the eventSize property supported by the
single-port version, themultiport implementation addstheability tocontrol
thecharacter setusedtointerpret theeventsonaper-portbasis.Thedefault
character set, which is normally UTF-8, is controlled by the
charset.default property and the others set by
charset.port.<port> . This example sets the default to UTF-16 and port
10003 to use UTF-8:
agent_1.source.source-1.charset.default=UTF-16
agent_1.source.source-1.charset.port.10003=UTF-8
The Syslog source is implemented using Apache Mina and exposes some of
the tuning parameters available in that library. Generally speaking, these
settings do not need to be changed, but in some virtual environments
changing them might be necessary. The first parameters are the batch size
and the read buffer, set to 100 events and 1,024 bytes, respectively, by
default:
agent_1.source.source-1.batchSize=100
agent_1.source.source-1.readBufferSize=1024
The number of processors can also be controlled by configuration. The
Syslog Source spawns two reader threads for every processor and attempts
to auto-detect the number of available processors. In virtual environments,
this is the most likely to cause problems, as the apparent number of
processors is not necessarily indicative of actual processors available. To
override auto-detection, set the number of processors using the
numProcessors property:
agent_1.source.source-1.numProcessors=4
Finally, the Syslog source also has an UDP-based source. For this source,
only the address binding and port are required with the type set to
syslogudp :
agent_1.source.source-1.type=syslogudp
agent_1.source.source-1.bind=0.0.0.0
agent_1.source.source-1.port=5140