[syslog-ng] Alternate logging destination

[Alexander Clouter]

Hi,

Szeti, Balazs <szeti.balazs at hp.com> [20061106 16:33:57 +0100]:
>
> Hello!
> 
> I would like to design a centralized logging system with 50 edge nodes
> and one center.
> It's quiet important to have all the logs even if the center is
> unreachable. Is there a way to configure syslog-ng to use an alternate
> destination? For example if the centralized TCP destionation server is
> down, the edge node syslog-ng may log in to a local file, so the logs
> can be reached later manually. When the center server in online again
> syslog-ng may log online again.
> 
> Any ideas?
> 
Its all over UDP but I helped add multicast support to to do just this.  The 
network duplicates the syslog messages to each 'core' syslog server so it 
does not matter if one f the boxes disappears.

I'm still pondering about sync'ing/diff'ing the differences[1] however for 
the effort you would need to put in for a heartbeat system, this solution 
wins...in my book anyway :)

Cheers

Alex

[1] I don't think its a big problem as you really only need to bear that 
	there could be differences and so should grep both log files for the 
	time frame

> Thanks in advance:
> Balazs
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
> 
>