<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Isn't failover a feature of the
Professional Edition?<br>
<br>
We chose to run two syslog servers receiving the full syslog
stream from all hosts.<br>
If one goes down, the stream is available o nthe other.<br>
<br>
As Balazs states, merging the logs back together is difficult, so
we don't do that. During log review, we just look in both logs.<br>
<br>
Evan.<br>
<br>
<br>
On 03/07/2014 11:57 PM, Balazs Scheidler wrote:<br>
</div>
<blockquote
cite="mid:CAKcfE+YTJJfp2qreQu3oiR1apBdJ9nbhWX7W1Jga5ZZ3RBomeQ@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<p dir="ltr">You basically have two options:</p>
<p dir="ltr">1. use Linux-HA or keepalived or something similar to
coordinate master-slave relationship. Have syslog-ng listen on
the service IP. Perhaps combine this with DNS round robin to
balance the load between the nodes.</p>
<p dir="ltr">2. Use an external load balancer that distributes
connections between hosts. This only works as long as you have
many clients as load balancers tend to balance based on a per
connection basis.</p>
<p dir="ltr">The complexity of the whole thing is when you want to
merge messages delivered to either of the cluster members. You
can either do that after the fact (syslog-ng will not help you
here, it just puts messages in plain text files), or use some
kind of nosql db that provides sharding and eventual
consistency.</p>
<p dir="ltr">Hth,</p>
<div class="gmail_quote">On Mar 7, 2014 9:51 PM, "Ramesh Basukala"
<<a moz-do-not-send="true"
href="mailto:basukalaramesh@gmail.com">basukalaramesh@gmail.com</a>>
wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
I am running open source version of syslog-ng server,
currently I have<br>
only one server. I would like to add another server and
configure high<br>
availability, such that log data will still be available in
case my<br>
primary server dies.<br>
Looking at the documentation, syslog-ng itself does not
support high<br>
availability configuration and has to be done at Operating
System level.<br>
<br>
I need help setting up high availability, please point me to
any<br>
resource or documentation to start with.<br>
<br>
Thanks for the help.<br>
-RB<br>
</blockquote>
</div>
</blockquote>
<br>
</body>
</html>