[syslog-ng]Central syslog with relays configuration

SPINDLER Loïc TRANSPAC syslog-ng@lists.balabit.hu
Wed, 23 Jun 2004 18:47:36 +0200


I am on designing a central log system in order to "concentrate" gigabytes 
(~12 daily) of logs from 3 delocalized platforms. Quickly here is how it 
works. I have 3 sites on which approximately 100 hosts push syslog 
messages to local relay over udp. My 3 relays just forward over tcp the 
syslog messages to a centralhost using syslog-ng.
On my concentrator (centralhost) I receive and store those messages using 
syslog-ng.
I have the configuration running in a lab with no problem.

But what happens in case the concentrator fails (f.o. hardware pb) :  Will 
the relays keep the messages somewhere ? can this be set up someway ?

At this time I did not success in programming a fifo to have the messages 
written in case the network forward could not be done. Anybody did ?

thanks,

loïc spindler