<div dir="ltr">Hi Daniel,<br><br>Thanks for your prompt reply. Can you give a rough idea about the possible increase in load when I use tcp instead of udp?<br><div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Tue, Apr 2, 2013 at 12:28 PM, Daniel Neubacher <span dir="ltr"><<a href="mailto:daniel.neubacher@xing.com" target="_blank">daniel.neubacher@xing.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="DE">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">The cheapest option is to change the complete environment to syslog-ng and tcp transport. Tcp works way better than udp and if you adjust the client
fifo a bit you have quite a bit messages cached in the memory. I have this setup running with 800 clients and all clients are of course logging to two servers.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Von:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>]
<b>Im Auftrag von </b>Abhijeet Rastogi<br>
<b>Gesendet:</b> Dienstag, 2. April 2013 07:38<br>
<b>An:</b> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
<b>Betreff:</b> [syslog-ng] High availability for syslog-ng<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi,<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Currently, I've just one syslog-ng server which receives messages from hundreds of rsyslog instances. I'm sending logs via UDP so if syslog-ng machine dies, logs will be missed.<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">How can I make the system more redundant? I want to achieve something like if the current syslog-ng machine goes down, some other machine should be able to take it's role.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Any kind of help is highly appreciated. Thanks<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">-- <u></u><u></u></p>
<div>
<p class="MsoNormal">Regards,<br>
Abhijeet Rastogi (shadyabhi)<br>
<a href="http://blog.abhijeetr.com" target="_blank">http://blog.abhijeetr.com</a><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></div>
</div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr">Regards,<br>Abhijeet Rastogi (shadyabhi)<br><a href="http://blog.abhijeetr.com" target="_blank">http://blog.abhijeetr.com</a></div>
</div>