[syslog-ng] High availability for syslog-ng

[Daniel Neubacher]

I didn't notice any load increase with tcp transport. The client connection stays open after connecting to the server so the traffic is quite small. One more advantage over udp is that you are actually seeing dropped message statistics if a server should fail.

Two years ago i've tested a syslog setup with rsyslog and tcp (and relp) and it was absolutely horrible. If you have any experience with this kind of setup please don't compare it to the syslog-ng implementation :)


Von: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] Im Auftrag von Abhijeet Rastogi
Gesendet: Dienstag, 2. April 2013 09:13
An: Syslog-ng users' and developers' mailing list
Betreff: Re: [syslog-ng] High availability for syslog-ng

Hi Daniel,

Thanks for your prompt reply. Can you give a rough idea about the possible increase in load when I use tcp instead of udp?

On Tue, Apr 2, 2013 at 12:28 PM, Daniel Neubacher <daniel.neubacher at xing.com<mailto:daniel.neubacher at xing.com>> wrote:
The cheapest option is to change the complete environment to syslog-ng and tcp transport. Tcp works way better than udp and if you adjust the client fifo a bit you have quite a bit messages cached in the memory. I have this setup running with 800 clients and all clients are of course logging to two servers.

Von: syslog-ng-bounces at lists.balabit.hu<mailto:syslog-ng-bounces at lists.balabit.hu> [mailto:syslog-ng-bounces at lists.balabit.hu<mailto:syslog-ng-bounces at lists.balabit.hu>] Im Auftrag von Abhijeet Rastogi
Gesendet: Dienstag, 2. April 2013 07:38
An: syslog-ng at lists.balabit.hu<mailto:syslog-ng at lists.balabit.hu>
Betreff: [syslog-ng] High availability for syslog-ng

Hi,
Currently, I've just one syslog-ng server which receives messages from hundreds of rsyslog instances. I'm sending logs via UDP so if syslog-ng machine dies, logs will be missed.
How can I make the system more redundant? I want to achieve something like if the current syslog-ng machine goes down, some other machine should be able to take it's role.
Any kind of help is highly appreciated. Thanks

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq




--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20130402/245866d2/attachment-0001.htm