[syslog-ng] Alternate logging destination
ac56 at soas.ac.uk
Mon Nov 6 17:45:44 CET 2006
Szeti, Balazs <szeti.balazs at hp.com> [20061106 16:33:57 +0100]:
> I would like to design a centralized logging system with 50 edge nodes
> and one center.
> It's quiet important to have all the logs even if the center is
> unreachable. Is there a way to configure syslog-ng to use an alternate
> destination? For example if the centralized TCP destionation server is
> down, the edge node syslog-ng may log in to a local file, so the logs
> can be reached later manually. When the center server in online again
> syslog-ng may log online again.
> Any ideas?
Its all over UDP but I helped add multicast support to to do just this. The
network duplicates the syslog messages to each 'core' syslog server so it
does not matter if one f the boxes disappears.
I'm still pondering about sync'ing/diff'ing the differences however for
the effort you would need to put in for a heartbeat system, this solution
wins...in my book anyway :)
 I don't think its a big problem as you really only need to bear that
there could be differences and so should grep both log files for the
> Thanks in advance:
> syslog-ng maillist - syslog-ng at lists.balabit.hu
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
More information about the syslog-ng