Specifying the sensor
A sensor reads a log file and forwards the data collected to the extractor. The next step is to specify how your sensor should work.
Click the sensor. Its properties are shown in Figure 5, which also shows the values set for the daemon.log sensor.
Figure 5. Setting the sensor for daemon.log
Because daemon.log is a single file, you don't need to change the Sensor type option. The Description field provides for clarity of purpose. Maximum blocking defines the number of lines to read before passing the input along to the extractor. Because entries in daemon.log tend to span many lines,
10 is a reasonable setting. The value for Confidence buffer size dictates the size of a buffer to contain the last n bytes of the log file. If the log file changes -- that is, the last n bytes differ from what's retained in the Confidence buffer -- the sensor reads more input. The default is 1,024 bytes, which is sufficient for this example.
Some logs append a footer to the end of the log file (each time new data is written). Usually, this data is best ignored, so to skip the footer, specify the number of bytes to skip in File footer size. Daemon.log doesn't have a footer, so the value is set to
If you expand the Sensor type (by clicking on the arrow), you'll see two additional properties: directory and fileName. These properties are initially set to the location and name of your template log file, but you'll soon switch them to process live data.
Don't forget to save the configuration file after setting the sensor properties. And, in general, always save the configuration file before you attempt to run the adapter.