<div dir="ltr"><div>Hello,</div><div> </div><div>you can create a syslog-ng cluster, using corosync/pacemaker/drbd.</div><div>This will allow you to have an active/passive syslog-ng cluster, if one node have an issue you simply move to the other node.</div>
<div> </div><div>Hugo</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 2 April 2013 09:30, Daniel Neubacher <span dir="ltr"><<a href="mailto:daniel.neubacher@xing.com" target="_blank">daniel.neubacher@xing.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="DE" vlink="purple" link="blue">
<div>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt" lang="EN-US">I didn’t notice any load increase with tcp transport. The client connection stays open after connecting to the server so the traffic is quite small.
One more advantage over udp is that you are actually seeing dropped message statistics if a server should fail.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt" lang="EN-US">Two years ago i’ve tested a syslog setup with rsyslog and tcp (and relp) and it was absolutely horrible. If you have any experience with this kind
of setup please don’t compare it to the syslog-ng implementation </span><span style="color:rgb(31,73,125);font-family:Wingdings;font-size:11pt" lang="EN-US">J</span><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt" lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Tahoma","sans-serif";font-size:10pt">Von:</span></b><span style="font-family:"Tahoma","sans-serif";font-size:10pt"> <a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>]
<b>Im Auftrag von </b>Abhijeet Rastogi<br>
<b>Gesendet:</b> Dienstag, 2. April 2013 09:13<br>
<b>An:</b> Syslog-ng users' and developers' mailing list<br>
<b>Betreff:</b> Re: [syslog-ng] High availability for syslog-ng<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi Daniel,<br>
<br>
Thanks for your prompt reply. Can you give a rough idea about the possible increase in load when I use tcp instead of udp?<u></u><u></u></p>
</div>
<div>
<p style="margin-bottom:12pt" class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Tue, Apr 2, 2013 at 12:28 PM, Daniel Neubacher <<a href="mailto:daniel.neubacher@xing.com" target="_blank">daniel.neubacher@xing.com</a>> wrote:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt" lang="EN-US">The cheapest option is to change the complete environment to syslog-ng and tcp transport.
Tcp works way better than udp and if you adjust the client fifo a bit you have quite a bit messages cached in the memory. I have this setup running with 800 clients and all clients are of course logging to two servers.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt" lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-family:"Tahoma","sans-serif";font-size:10pt">Von:</span></b><span style="font-family:"Tahoma","sans-serif";font-size:10pt">
<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>]
<b>Im Auftrag von </b>Abhijeet Rastogi<br>
<b>Gesendet:</b> Dienstag, 2. April 2013 07:38<br>
<b>An:</b> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
<b>Betreff:</b> [syslog-ng] High availability for syslog-ng</span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<div>
<div>
<p style="margin-bottom:12pt" class="MsoNormal">Hi,<u></u><u></u></p>
</div>
<p style="margin-bottom:12pt" class="MsoNormal">Currently, I've just one syslog-ng server which receives messages from hundreds of rsyslog instances. I'm sending logs via UDP so if syslog-ng machine dies, logs will be missed.<u></u><u></u></p>
</div>
<p style="margin-bottom:12pt" class="MsoNormal">How can I make the system more redundant? I want to achieve something like if the current syslog-ng machine goes down, some other machine should be able to take it's role.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Any kind of help is highly appreciated. Thanks<u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">--
<u></u><u></u></p>
<div>
<p class="MsoNormal">Regards,<br>
Abhijeet Rastogi (shadyabhi)<br>
<a href="http://blog.abhijeetr.com" target="_blank">http://blog.abhijeetr.com</a><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p style="margin-bottom:12pt" class="MsoNormal"><br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<br>
-- <u></u><u></u></p>
<div>
<p class="MsoNormal">Regards,<br>
Abhijeet Rastogi (shadyabhi)<br>
<a href="http://blog.abhijeetr.com" target="_blank">http://blog.abhijeetr.com</a><u></u><u></u></p>
</div>
</div>
</div></div></div>
</div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>