I have been doing this and recent messages on this list suggest many others are too. The solution that I settled on was to cluster the two syslog-ng servers so that syslog-ng only ran on one server and failed over to the other if the first server died. The logs are written to a clustered filesystem on a SAN. I did consider running syslog-ng on both servers and then trying to do some kind of log file reconciliation every night but decided that would be too hard. To do the clustering we are using Poyserve but there are lots of other clustering systems out there that you could use. The big problem that I have is the loss of log messages during failover. If anyone else has suggested configs or ideas on minimising this I would be very interested to hear. Thanks John syslog-ng-bounces@lists.balabit.hu wrote on 01/11/2005 19:36:29:
Hi,
I would like to setup two syslog server so that I don't need to have outage if I need to do some update/upgrade on the system, my questions is how should I set it up? I can send all the traffic to both servers, but I can only load the data to a database on one system at a time. If I need to down the primary system, that mean I need to switch to the secondary to load the data and switch it back when primary is up again. How I can make sure I get all the data load on the database and make sure the syslog data on both servers are the same?
Thanks.
Hermann_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html