[syslog-ng] Syslog-ng and network failover

[Hari Sekhon]

I don't think syslog-ng supports this nor do I know of any other logger 
that does.

Would it be acceptable to have it log to 2 different log servers, that 
way, you would get a measure of high availability.


In any case, if you're using tcp destinations then it will hold the logs 
until the server becomes available again (up to a point - then any 
following logs will be lost)

You could give your clients massive fifos to try to buy more time (well 
more log store actually), I think this will make them more resilient to 
server unavailability as they can cache more logs.

Anyone else got any bright ideas on this?


-h

Hari Sekhon



Jonathon Blumenthal wrote:
> I need to have a highly available centralized log server (all Linux). 
>
> Is there a way to configure syslog-ng to automatically detect when the
> remote syslog server has gone down so that it can redirect messages
> elsewhere? 
>
> Something like this:
> destination d_tcp1 { tcp("192.168.1.1"); failover(d_tcp2); };
> destination d_tcp2 { tcp("192.168.1.2"); };
>
> If not, anyone know of any Linux loggers that will do this?
>
> -Jon
>
> -----------------------------------------
> The information contained in this email message and its attachments
> is intended only for the private and confidential use of the
> recipient(s) named above, unless the sender expressly agrees
> otherwise.
> Transmission of email over the Internet is not a secure
> communications medium. If you are requesting or have requested the
> transmittal of personal data, as defined in applicable privacy laws
> by means of email or in an attachment to email, you must select a
> more secure alternate means of transmittal that supports your
> obligations to protect such personal data.
> If the reader of this message is not the intended recipient and/or
> you have received this email in error, you must take no action
> based on the information in this email and you are hereby notified
> that any dissemination, misuse or copying or disclosure of this
> communication is strictly prohibited. If you have received this
> communication in error, please notify us immediately by email and
> delete the original message.
>
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>
>
>