Hi Daniel, Thanks for your prompt reply. Can you give a rough idea about the possible increase in load when I use tcp instead of udp? On Tue, Apr 2, 2013 at 12:28 PM, Daniel Neubacher <daniel.neubacher@xing.com

wrote:

The cheapest option is to change the complete environment to syslog-ng and tcp transport. Tcp works way better than udp and if you adjust the client fifo a bit you have quite a bit messages cached in the memory. I have this setup running with 800 clients and all clients are of course logging to two servers.****

** **

*Von:* syslog-ng-bounces@lists.balabit.hu [mailto: syslog-ng-bounces@lists.balabit.hu] *Im Auftrag von *Abhijeet Rastogi *Gesendet:* Dienstag, 2. April 2013 07:38 *An:* syslog-ng@lists.balabit.hu *Betreff:* [syslog-ng] High availability for syslog-ng****

** **

Hi,****

Currently, I've just one syslog-ng server which receives messages from hundreds of rsyslog instances. I'm sending logs via UDP so if syslog-ng machine dies, logs will be missed.****

How can I make the system more redundant? I want to achieve something like if the current syslog-ng machine goes down, some other machine should be able to take it's role.****

Any kind of help is highly appreciated. Thanks****

** **

-- ****

Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com****

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

-- Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com

Hello, you can create a syslog-ng cluster, using corosync/pacemaker/drbd. This will allow you to have an active/passive syslog-ng cluster, if one node have an issue you simply move to the other node. Hugo On 2 April 2013 09:30, Daniel Neubacher <daniel.neubacher@xing.com> wrote:

I didn’t notice any load increase with tcp transport. The client connection stays open after connecting to the server so the traffic is quite small. One more advantage over udp is that you are actually seeing dropped message statistics if a server should fail.****

** **

Two years ago i’ve tested a syslog setup with rsyslog and tcp (and relp) and it was absolutely horrible. If you have any experience with this kind of setup please don’t compare it to the syslog-ng implementation J****

** **

** **

*Von:* syslog-ng-bounces@lists.balabit.hu [mailto: syslog-ng-bounces@lists.balabit.hu] *Im Auftrag von *Abhijeet Rastogi *Gesendet:* Dienstag, 2. April 2013 09:13 *An:* Syslog-ng users' and developers' mailing list *Betreff:* Re: [syslog-ng] High availability for syslog-ng****

** **

Hi Daniel,

Thanks for your prompt reply. Can you give a rough idea about the possible increase in load when I use tcp instead of udp?****

** **

On Tue, Apr 2, 2013 at 12:28 PM, Daniel Neubacher < daniel.neubacher@xing.com> wrote:****

The cheapest option is to change the complete environment to syslog-ng and tcp transport. Tcp works way better than udp and if you adjust the client fifo a bit you have quite a bit messages cached in the memory. I have this setup running with 800 clients and all clients are of course logging to two servers.****

****

*Von:* syslog-ng-bounces@lists.balabit.hu [mailto: syslog-ng-bounces@lists.balabit.hu] *Im Auftrag von *Abhijeet Rastogi *Gesendet:* Dienstag, 2. April 2013 07:38 *An:* syslog-ng@lists.balabit.hu *Betreff:* [syslog-ng] High availability for syslog-ng****

****

Hi,****

Currently, I've just one syslog-ng server which receives messages from hundreds of rsyslog instances. I'm sending logs via UDP so if syslog-ng machine dies, logs will be missed.****

How can I make the system more redundant? I want to achieve something like if the current syslog-ng machine goes down, some other machine should be able to take it's role.****

Any kind of help is highly appreciated. Thanks****

****

-- ****

Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com****

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

****

-- ****

Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com****

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Evan Rempel <erempel@uvic.ca> writes:

If you look at the lsof output for a program destination you can see that the syslog-ng persistent file is still open for the application.

I don't think this should be the case.

Agreed, the persist file should have the close-on-exec flag. Thanks for noticing! -- |8]