[syslog-ng] Load balancing in syslog-ng(verison 3.0)

[Martin Holste]

You could try a match() with $SEQNUM which is an ever-increasing
counter.  A regex that looked for even $SEQNUM's would perfectly load
balance.

On Thu, Sep 22, 2011 at 9:17 AM, Fekete Robert <frobert at balabit.hu> wrote:
> Check your logs and see which characteristics can be used to balance them. If
> they are coming from a single host, try to filter by program name, or facility.
>
> HTH
>
> Robert
>
> On 09/22/2011 02:33 PM, Jain, Vaibhav (GE Healthcare) wrote:
>
>> Hi,
>>
>> Thanks for your quick response.
>> In my case logs are coming from one source machine. Let me know how to
>> put the filter condition for sharing the load.
>>
>> Regards,
>> Vaibhav
>>
>> -----Original Message-----
>> From: syslog-ng-bounces at lists.balabit.hu
>> [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Gergely Nagy
>> Sent: Thursday, September 22, 2011 5:29 PM
>> To: Syslog-ng users' and developers' mailing list
>> Subject: Re: [syslog-ng] Load balancing in syslog-ng(verison 3.0)
>>
>> "Jain, Vaibhav (GE Healthcare)"<Vaibhav.Jain at ge.com>  writes:
>>
>>> In my syslog-ng server configuration file I want to divide the
>>> messages in 2 different pipes to share the load. Please let me know
>>
>> The simplest approach would be to filter the messages, based on a
>> condition that would evenly distribute them (what such a condition is,
>> depends on your logs, and it may not even exist), and send them towards
>> different destinations.
>>
>> For example, assuming you have two client hosts, src1 and src2, and two
>> destinations: dst1, and dst2, your config could look like this:
>>
>> source s_network { tcp(); };
>> destination d_dst1 { tcp("dst1.local"); }; destination d_dst2 {
>> tcp("dst2.local"); };
>>
>> filter f_host1 { host("src1"); };
>>
>> log { source(s_network); filter(f_host1); destination(d_dst1);
>> flags(final); }; log { source(s_network); destination(d_dst2); };
>>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>