Hi,

I was considering a config-based solution: have all clients send to multiple
syslog-ng servers (e.g. using multicast), after adding a unique identifier
to each message (e.g. using the uuid template function).

Then have all syslog aggregators ship their copy to a common storage, the
unique key enabling you to identify/drop the multiple copies of the same message,

Cheers

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq