<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:Calibri;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Multiple syslog servers isn’t an option with a lot of these systems. We could possibly have the relay server relay to multiple servers on the backend, but we’re loading this data into Splunk and don’t want
redundant data to be loaded in.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Times New Roman";color:#0070C0">Joe Lupo</span><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Times New Roman";color:fuchsia">T</span><span style="font-size:11.0pt;font-family:"Times New Roman";color:gray">-Mobile USA</span><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Times New Roman";color:#0070C0">Principal Engineer, System Design & Strategy</span><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Times New Roman";color:#0070C0">(973) 440-8768</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black"><syslog-ng-bounces@lists.balabit.hu> on behalf of Evan Rempel <erempel@uvic.ca><br>
<b>Reply-To: </b>Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Date: </b>Thursday, August 11, 2016 at 11:19 PM<br>
<b>To: </b>"syslog-ng@lists.balabit.hu" <syslog-ng@lists.balabit.hu><br>
<b>Subject: </b>Re: [syslog-ng] Syslog-ng client through a load balancer with SSL/TLS encryption<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Times New Roman""><o:p> </o:p></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal">IMHO The best way to have redundant logging it to log to multiple syslog servers from each source server. For devices that can only log to one device I would log to a dedicated log replicator that send a copy of the log event to the multiple
syslog servers just as if the client could have sent to multiple syslog server on its own.<br>
<br>
Evan. <br>
<br>
On 08/11/2016 03:07 PM, Lupo, Joseph wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt">I am trying to setup Syslog-ng to relay messages from one syslog server to another with a load balancer in between. I am also using TLS encryption. The issue I’m having right now is that when the client
intiates the connection, it seems to lock on to a particular back end syslog server and send all of its messages there instead of switching off to another one. On its own this isn’t a big problem except that if that system goes down, the client doesn’t seem
to be aware. I also haven’t found a good way to force syslog-ng to close and re-establish its connections without fully shutting down the relay system. We currently have no persistence setup on the load balancer.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Is there a way to tell the relay server to periodically reconnect? Maybe send a certain amount of messages or data before reconnecting so that the data is balanced across the backend syslog-ng servers? Also,
is there a better way to have the relay system learn about the remote server going offline so it can immediately reset its connection?</span><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span style="font-family:"Times New Roman""><o:p> </o:p></span></p>
</div>
</div>
</div>
</body>
</html>