Check your logs and see which characteristics can be used to balance them. If they are coming from a single host, try to filter by program name, or facility. HTH Robert On 09/22/2011 02:33 PM, Jain, Vaibhav (GE Healthcare) wrote:
Hi,
Thanks for your quick response. In my case logs are coming from one source machine. Let me know how to put the filter condition for sharing the load.
Regards, Vaibhav
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Gergely Nagy Sent: Thursday, September 22, 2011 5:29 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Load balancing in syslog-ng(verison 3.0)
"Jain, Vaibhav (GE Healthcare)"<Vaibhav.Jain@ge.com> writes:
In my syslog-ng server configuration file I want to divide the messages in 2 different pipes to share the load. Please let me know
The simplest approach would be to filter the messages, based on a condition that would evenly distribute them (what such a condition is, depends on your logs, and it may not even exist), and send them towards different destinations.
For example, assuming you have two client hosts, src1 and src2, and two destinations: dst1, and dst2, your config could look like this:
source s_network { tcp(); }; destination d_dst1 { tcp("dst1.local"); }; destination d_dst2 { tcp("dst2.local"); };
filter f_host1 { host("src1"); };
log { source(s_network); filter(f_host1); destination(d_dst1); flags(final); }; log { source(s_network); destination(d_dst2); };