RE: [syslog-ng] Xserve sending to Syslog-NG
Yes the syslog feed off the xserve is most likely UDP based and it will just continue to stream syslog messages to the unresponsive destination. There may or may not be a way to setup a backup syslog server in the Xserve admin functions. WilliamB -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Ken Garland Sent: Wednesday, January 25, 2006 2:30 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Xserve sending to Syslog-NG I have a question regarding setting up an Xserve to send to our central log server. If the Syslog-NG server goes down, will the Xserve continuously retry to send the logs until the Syslog-NG server is available? _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Wed, Jan 25, 2006 at 02:31:50PM -0700, William Bell wrote:
Yes the syslog feed off the xserve is most likely UDP based and it will just continue to stream syslog messages to the unresponsive destination. There may or may not be a way to setup a backup syslog server in the Xserve admin functions.
WilliamB
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Ken Garland Sent: Wednesday, January 25, 2006 2:30 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Xserve sending to Syslog-NG
I have a question regarding setting up an Xserve to send to our central log server. If the Syslog-NG server goes down, will the Xserve continuously retry to send the logs until the Syslog-NG server is available?
Of course I feel that I have to mention the possiblity of installing syslog-ng on the Xserve, configuring a TCP connection to the central syslog-ng server and setting a large enough buffer to not lose logs during an outage (whatever that means for the amount of logs your client typically sends and how long you think your central server will be down and how much memory you want to use up when the buffer is full - you'll probably just have to guess). -- Nate I've seen things you people wouldn't believe. Attack ships on fire off the shoulder of Orion. I watched C-beams glitter in the dark near the Tannhauser gate. All those moments will be lost in time, like tears in rain. Time to die. -- Roy Batty, Blade Runner
I do have Syslog-NG setup on several clients with TCP, however I will not be doing this on the Xserve. I guess it would be more trouble than it is worth for me to write a script that can detect when the central log server is down and remove the entry that sends remotely. Thanks for answering my question, I'll leave the Syslog system on our Xserve's alone. - Ken On Jan 25, 2006, at 4:52 PM, Nate Campi wrote:
On Wed, Jan 25, 2006 at 02:31:50PM -0700, William Bell wrote:
Yes the syslog feed off the xserve is most likely UDP based and it will just continue to stream syslog messages to the unresponsive destination. There may or may not be a way to setup a backup syslog server in the Xserve admin functions.
WilliamB
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Ken Garland Sent: Wednesday, January 25, 2006 2:30 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Xserve sending to Syslog-NG
I have a question regarding setting up an Xserve to send to our central log server. If the Syslog-NG server goes down, will the Xserve continuously retry to send the logs until the Syslog-NG server is available?
Of course I feel that I have to mention the possiblity of installing syslog-ng on the Xserve, configuring a TCP connection to the central syslog-ng server and setting a large enough buffer to not lose logs during an outage (whatever that means for the amount of logs your client typically sends and how long you think your central server will be down and how much memory you want to use up when the buffer is full - you'll probably just have to guess). -- Nate
I've seen things you people wouldn't believe. Attack ships on fire off the shoulder of Orion. I watched C-beams glitter in the dark near the Tannhauser gate. All those moments will be lost in time, like tears in rain. Time to die. -- Roy Batty, Blade Runner
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
I think Will left out the answer you were after. If the Xserve is doing UDP transport, and syslog-ng goes on vacation, the messages sent while syslog-ng is unavailable will be lost. - billn On Wed, 25 Jan 2006, William Bell wrote:
Yes the syslog feed off the xserve is most likely UDP based and it will just continue to stream syslog messages to the unresponsive destination. There may or may not be a way to setup a backup syslog server in the Xserve admin functions.
WilliamB
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Ken Garland Sent: Wednesday, January 25, 2006 2:30 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Xserve sending to Syslog-NG
I have a question regarding setting up an Xserve to send to our central log server. If the Syslog-NG server goes down, will the Xserve continuously retry to send the logs until the Syslog-NG server is available?
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
participants (4)
-
Bill Nash
-
Ken Garland
-
Nate Campi
-
William Bell