Hi Daniel, Thanks for your prompt reply. Can you give a rough idea about the possible increase in load when I use tcp instead of udp? On Tue, Apr 2, 2013 at 12:28 PM, Daniel Neubacher <daniel.neubacher@xing.com
wrote:
The cheapest option is to change the complete environment to syslog-ng and tcp transport. Tcp works way better than udp and if you adjust the client fifo a bit you have quite a bit messages cached in the memory. I have this setup running with 800 clients and all clients are of course logging to two servers.****
** **
*Von:* syslog-ng-bounces@lists.balabit.hu [mailto: syslog-ng-bounces@lists.balabit.hu] *Im Auftrag von *Abhijeet Rastogi *Gesendet:* Dienstag, 2. April 2013 07:38 *An:* syslog-ng@lists.balabit.hu *Betreff:* [syslog-ng] High availability for syslog-ng****
** **
Hi,****
Currently, I've just one syslog-ng server which receives messages from hundreds of rsyslog instances. I'm sending logs via UDP so if syslog-ng machine dies, logs will be missed.****
How can I make the system more redundant? I want to achieve something like if the current syslog-ng machine goes down, some other machine should be able to take it's role.****
Any kind of help is highly appreciated. Thanks****
** **
-- ****
Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com****
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-- Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com