Hi Terry, Thanks for your suggestion. The reason I am trying to configure high availability with heartbeat/DRBD is data consistency. I prefer no to have 2 different sets of data in case one of the syslog server went offline. Do you think we might be able to rsync the log folder once in a while to make data consistent? Thanks, RB On Mon, Mar 10, 2014 at 1:58 PM, Terry Slattery <tcs@netcraftsmen.net>wrote:
My recommendation to customers who need high reliability is to run two instances, each in a separate data center. Configure all gear to send to both servers. If syslog forwarding to other consumers is needed, manually configure it on one of the two servers. Upon a failure, confirmed by a human, the servers are reconfigured for forwarding. Many syslog consumers can't handle more than one feed, thus the need to reconfigure upon a failure.
This isn't optimum for a site that wants automatic operation. However, building a system that can properly determine and avoid split-brain failures (where the two systems can't talk with one another, but the network gear can send to them) is an "interesting challenge." It would be easy to build something to generate an alert when the two systems can't talk with one another and make this alert the highest priority. Humans can then step in to diagnose the problem and take the appropriate action. Meanwhile, both systems are logging whatever they receive, which may be the whole feed or a part of a feed, if the network becomes partitioned.
-tcs
On 3/8/14 2:57 AM, syslog-ng-request@lists.balabit.hu wrote:
Date: Fri, 07 Mar 2014 15:50:43 -0500 From: Ramesh Basukala<basukalaramesh@gmail.com> Subject: [syslog-ng] High availabilty configuration To:syslog-ng@lists.balabit.hu Message-ID:<531A3123.5080007@gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Hi,
I am running open source version of syslog-ng server, currently I have only one server. I would like to add another server and configure high availability, such that log data will still be available in case my primary server dies. Looking at the documentation, syslog-ng itself does not support high availability configuration and has to be done at Operating System level.
I need help setting up high availability, please point me to any resource or documentation to start with.
Thanks for the help. -RB
-- Terry Slattery CCIE# 1026
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq