<div dir="ltr">Hi Terry,<div><br></div><div>Thanks for your suggestion. The reason I am trying to configure high availability with heartbeat/DRBD is data consistency. I prefer no to have 2 different sets of data in case one of the syslog server went offline. Do you think we might be able to rsync the log folder once in a while to make data consistent?</div>
<div><br></div><div>Thanks,</div><div>RB</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Mar 10, 2014 at 1:58 PM, Terry Slattery <span dir="ltr"><<a href="mailto:tcs@netcraftsmen.net" target="_blank">tcs@netcraftsmen.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">My recommendation to customers who need high reliability is to run two<br>
instances, each in a separate data center. Configure all gear to send to both<br>
servers. If syslog forwarding to other consumers is needed, manually configure<br>
it on one of the two servers. Upon a failure, confirmed by a human, the servers<br>
are reconfigured for forwarding. Many syslog consumers can't handle more than<br>
one feed, thus the need to reconfigure upon a failure.<br>
<br>
This isn't optimum for a site that wants automatic operation. However, building<br>
a system that can properly determine and avoid split-brain failures (where the<br>
two systems can't talk with one another, but the network gear can send to them)<br>
is an "interesting challenge." It would be easy to build something to generate<br>
an alert when the two systems can't talk with one another and make this alert<br>
the highest priority. Humans can then step in to diagnose the problem and take<br>
the appropriate action. Meanwhile, both systems are logging whatever they<br>
receive, which may be the whole feed or a part of a feed, if the network becomes<br>
partitioned.<br>
<br>
-tcs<br>
<br>
On 3/8/14 2:57 AM, <a href="mailto:syslog-ng-request@lists.balabit.hu">syslog-ng-request@lists.balabit.hu</a> wrote:<br>
> Date: Fri, 07 Mar 2014 15:50:43 -0500<br>
> From: Ramesh Basukala<<a href="mailto:basukalaramesh@gmail.com">basukalaramesh@gmail.com</a>><br>
> Subject: [syslog-ng] High availabilty configuration<br>
> <a href="mailto:To%3Asyslog-ng@lists.balabit.hu">To:syslog-ng@lists.balabit.hu</a><br>
> Message-ID:<<a href="mailto:531A3123.5080007@gmail.com">531A3123.5080007@gmail.com</a>><br>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed<br>
><br>
> Hi,<br>
><br>
> I am running open source version of syslog-ng server, currently I have<br>
> only one server. I would like to add another server and configure high<br>
> availability, such that log data will still be available in case my<br>
> primary server dies.<br>
> Looking at the documentation, syslog-ng itself does not support high<br>
> availability configuration and has to be done at Operating System level.<br>
><br>
> I need help setting up high availability, please point me to any<br>
> resource or documentation to start with.<br>
><br>
> Thanks for the help.<br>
> -RB<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Terry Slattery CCIE# 1026<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</font></span></blockquote></div><br></div>