[syslog-ng] Load balancing in syslog-ng(verison 3.0)

[Fekete Robert]

Check your logs and see which characteristics can be used to balance them. If 
they are coming from a single host, try to filter by program name, or facility.

HTH

Robert

On 09/22/2011 02:33 PM, Jain, Vaibhav (GE Healthcare) wrote:

> Hi,
>
> Thanks for your quick response.
> In my case logs are coming from one source machine. Let me know how to
> put the filter condition for sharing the load.
>
> Regards,
> Vaibhav
>
> -----Original Message-----
> From: syslog-ng-bounces at lists.balabit.hu
> [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Gergely Nagy
> Sent: Thursday, September 22, 2011 5:29 PM
> To: Syslog-ng users' and developers' mailing list
> Subject: Re: [syslog-ng] Load balancing in syslog-ng(verison 3.0)
>
> "Jain, Vaibhav (GE Healthcare)"<Vaibhav.Jain at ge.com>  writes:
>
>> In my syslog-ng server configuration file I want to divide the
>> messages in 2 different pipes to share the load. Please let me know
>
> The simplest approach would be to filter the messages, based on a
> condition that would evenly distribute them (what such a condition is,
> depends on your logs, and it may not even exist), and send them towards
> different destinations.
>
> For example, assuming you have two client hosts, src1 and src2, and two
> destinations: dst1, and dst2, your config could look like this:
>
> source s_network { tcp(); };
> destination d_dst1 { tcp("dst1.local"); }; destination d_dst2 {
> tcp("dst2.local"); };
>
> filter f_host1 { host("src1"); };
>
> log { source(s_network); filter(f_host1); destination(d_dst1);
> flags(final); }; log { source(s_network); destination(d_dst2); };
>