[syslog-ng] Alternate logging destination

Alexander Clouter ac56 at soas.ac.uk
Mon Nov 6 17:45:44 CET 2006


Szeti, Balazs <szeti.balazs at hp.com> [20061106 16:33:57 +0100]:
> Hello!
> I would like to design a centralized logging system with 50 edge nodes
> and one center.
> It's quiet important to have all the logs even if the center is
> unreachable. Is there a way to configure syslog-ng to use an alternate
> destination? For example if the centralized TCP destionation server is
> down, the edge node syslog-ng may log in to a local file, so the logs
> can be reached later manually. When the center server in online again
> syslog-ng may log online again.
> Any ideas?
Its all over UDP but I helped add multicast support to to do just this.  The 
network duplicates the syslog messages to each 'core' syslog server so it 
does not matter if one f the boxes disappears.

I'm still pondering about sync'ing/diff'ing the differences[1] however for 
the effort you would need to put in for a heartbeat system, this solution 
wins...in my book anyway :)



[1] I don't think its a big problem as you really only need to bear that 
	there could be differences and so should grep both log files for the 
	time frame

> Thanks in advance:
> Balazs
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

More information about the syslog-ng mailing list