But not everything sends a sequence number (or does syslog-ng have an internal one?)<div><br clear="all">______________________________________________________________ <br><br>Clayton Dukes<br>______________________________________________________________<br>
<br><br><div class="gmail_quote">On Fri, Sep 23, 2011 at 1:37 PM, Martin Holste <span dir="ltr"><<a href="mailto:mcholste@gmail.com">mcholste@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
You could try a match() with $SEQNUM which is an ever-increasing<br>
counter. A regex that looked for even $SEQNUM's would perfectly load<br>
balance.<br>
<div><div></div><div class="h5"><br>
On Thu, Sep 22, 2011 at 9:17 AM, Fekete Robert <<a href="mailto:frobert@balabit.hu">frobert@balabit.hu</a>> wrote:<br>
> Check your logs and see which characteristics can be used to balance them. If<br>
> they are coming from a single host, try to filter by program name, or facility.<br>
><br>
> HTH<br>
><br>
> Robert<br>
><br>
> On 09/22/2011 02:33 PM, Jain, Vaibhav (GE Healthcare) wrote:<br>
><br>
>> Hi,<br>
>><br>
>> Thanks for your quick response.<br>
>> In my case logs are coming from one source machine. Let me know how to<br>
>> put the filter condition for sharing the load.<br>
>><br>
>> Regards,<br>
>> Vaibhav<br>
>><br>
>> -----Original Message-----<br>
>> From: <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a><br>
>> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of Gergely Nagy<br>
>> Sent: Thursday, September 22, 2011 5:29 PM<br>
>> To: Syslog-ng users' and developers' mailing list<br>
>> Subject: Re: [syslog-ng] Load balancing in syslog-ng(verison 3.0)<br>
>><br>
>> "Jain, Vaibhav (GE Healthcare)"<<a href="mailto:Vaibhav.Jain@ge.com">Vaibhav.Jain@ge.com</a>> writes:<br>
>><br>
>>> In my syslog-ng server configuration file I want to divide the<br>
>>> messages in 2 different pipes to share the load. Please let me know<br>
>><br>
>> The simplest approach would be to filter the messages, based on a<br>
>> condition that would evenly distribute them (what such a condition is,<br>
>> depends on your logs, and it may not even exist), and send them towards<br>
>> different destinations.<br>
>><br>
>> For example, assuming you have two client hosts, src1 and src2, and two<br>
>> destinations: dst1, and dst2, your config could look like this:<br>
>><br>
>> source s_network { tcp(); };<br>
>> destination d_dst1 { tcp("dst1.local"); }; destination d_dst2 {<br>
>> tcp("dst2.local"); };<br>
>><br>
>> filter f_host1 { host("src1"); };<br>
>><br>
>> log { source(s_network); filter(f_host1); destination(d_dst1);<br>
>> flags(final); }; log { source(s_network); destination(d_dst2); };<br>
>><br>
><br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
><br>
><br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br></div>