Setting the maximum EPS rate

You can set the maximum events per second (EPS) rate that IBM® Disconnected Log Collector sends to IBM QRadar®.

The default is 5000. The maximum rate is applied to UDP and TLS over TCP connections to QRadar.

Procedure

  1. Log in to the Disconnected Log Collector computer or VM as the root user.
  2. Open the /opt/ibm/si/services/dlc/conf/config.json file in a text editor.
  3. In the EPS parameter, enter the maximum EPS rate that Disconnected Log Collector sends to QRadar.
  4. Save and close the config.json file.
  5. Restart Disconnected Log Collector by typing the following command: 
    systemctl restart dlc