I don't think syslog-ng supports this nor do I know of any other logger that does. Would it be acceptable to have it log to 2 different log servers, that way, you would get a measure of high availability. In any case, if you're using tcp destinations then it will hold the logs until the server becomes available again (up to a point - then any following logs will be lost) You could give your clients massive fifos to try to buy more time (well more log store actually), I think this will make them more resilient to server unavailability as they can cache more logs. Anyone else got any bright ideas on this? -h Hari Sekhon Jonathon Blumenthal wrote:
I need to have a highly available centralized log server (all Linux).
Is there a way to configure syslog-ng to automatically detect when the remote syslog server has gone down so that it can redirect messages elsewhere?
Something like this: destination d_tcp1 { tcp("192.168.1.1"); failover(d_tcp2); }; destination d_tcp2 { tcp("192.168.1.2"); };
If not, anyone know of any Linux loggers that will do this?
-Jon
----------------------------------------- The information contained in this email message and its attachments is intended only for the private and confidential use of the recipient(s) named above, unless the sender expressly agrees otherwise. Transmission of email over the Internet is not a secure communications medium. If you are requesting or have requested the transmittal of personal data, as defined in applicable privacy laws by means of email or in an attachment to email, you must select a more secure alternate means of transmittal that supports your obligations to protect such personal data. If the reader of this message is not the intended recipient and/or you have received this email in error, you must take no action based on the information in this email and you are hereby notified that any dissemination, misuse or copying or disclosure of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by email and delete the original message.
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html