[syslog-ng] Load balancing in syslog-ng(verison 3.0)

[Clayton Dukes]

But not everything sends a sequence number (or does syslog-ng have an
internal one?)

______________________________________________________________

Clayton Dukes
______________________________________________________________


On Fri, Sep 23, 2011 at 1:37 PM, Martin Holste <mcholste at gmail.com> wrote:

> You could try a match() with $SEQNUM which is an ever-increasing
> counter.  A regex that looked for even $SEQNUM's would perfectly load
> balance.
>
> On Thu, Sep 22, 2011 at 9:17 AM, Fekete Robert <frobert at balabit.hu> wrote:
> > Check your logs and see which characteristics can be used to balance
> them. If
> > they are coming from a single host, try to filter by program name, or
> facility.
> >
> > HTH
> >
> > Robert
> >
> > On 09/22/2011 02:33 PM, Jain, Vaibhav (GE Healthcare) wrote:
> >
> >> Hi,
> >>
> >> Thanks for your quick response.
> >> In my case logs are coming from one source machine. Let me know how to
> >> put the filter condition for sharing the load.
> >>
> >> Regards,
> >> Vaibhav
> >>
> >> -----Original Message-----
> >> From: syslog-ng-bounces at lists.balabit.hu
> >> [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Gergely Nagy
> >> Sent: Thursday, September 22, 2011 5:29 PM
> >> To: Syslog-ng users' and developers' mailing list
> >> Subject: Re: [syslog-ng] Load balancing in syslog-ng(verison 3.0)
> >>
> >> "Jain, Vaibhav (GE Healthcare)"<Vaibhav.Jain at ge.com>  writes:
> >>
> >>> In my syslog-ng server configuration file I want to divide the
> >>> messages in 2 different pipes to share the load. Please let me know
> >>
> >> The simplest approach would be to filter the messages, based on a
> >> condition that would evenly distribute them (what such a condition is,
> >> depends on your logs, and it may not even exist), and send them towards
> >> different destinations.
> >>
> >> For example, assuming you have two client hosts, src1 and src2, and two
> >> destinations: dst1, and dst2, your config could look like this:
> >>
> >> source s_network { tcp(); };
> >> destination d_dst1 { tcp("dst1.local"); }; destination d_dst2 {
> >> tcp("dst2.local"); };
> >>
> >> filter f_host1 { host("src1"); };
> >>
> >> log { source(s_network); filter(f_host1); destination(d_dst1);
> >> flags(final); }; log { source(s_network); destination(d_dst2); };
> >>
> >
> >
> >
> ______________________________________________________________________________
> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> > Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq
> >
> >
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110923/6bcd6554/attachment.htm