Charles Beierle

syslog stand-in

Discussion created by Charles Beierle on Dec 23, 2009
Latest reply on Mar 3, 2010 by RSA Admin

I would like to have a syslog standby service that would start only when the collector was stopped for device updates and software upgrades (or any other reason for that matter). The stand-in would write to disk files until 1)the collector service restarted and killed the standin OR 2)a certain disk threshold was met. This would support preservation of UDP event data while we take the realtime components out of service. A customized filereader would be developed to facilitate the digestion of the files once the system came up again.

Outcomes