[syslog-ng] High availabilty configuration

[Terry Slattery]

Ramesh,

My customers are network folks, not sysadmins. Network folks are good at 
networking and network troubleshooting, but not great at installing and 
maintaining things like DRBD. So DRBD is not an option.

I don't see how you could use rsync with the log folder to make a single data 
set. The folders/directories become different in a split-brain situation and 
rsync operates on files and directories.

Consider the split-brain case where two syslog-ng servers can't see each other 
and some network devices can still send to one of the two serves. The syslog-ng 
data now becomes different, with some devices able to log to one syslog-ng 
server, but not the other. If you're forwarding syslog data to other consumers 
(alerting systems, security systems, etc), only one server will typically be 
able to reach some of these systems. What happens depends on your architecture 
and the devices involved. This is what makes automatic handling difficult.

Failure of the syslog-ng server itself is easy to handle; it is a network 
failure that creates the split-brain situation that's difficult.

	-tcs

On 3/11/14 2:15 AM, syslog-ng-request at lists.balabit.hu wrote:
> Date: Mon, 10 Mar 2014 14:10:24 -0400
> From: Ramesh Basukala<basukalaramesh at gmail.com>
> Subject: Re: [syslog-ng] s High availabilty configuration
> To: "Syslog-ng users' and developers' mailing list"
> 	<syslog-ng at lists.balabit.hu>
> Message-ID:
> 	<CABJn1Wj3TEESuNsE1CcTvHKCBEKAhwOmV6gr6y8ibzR+w+U+MQ at mail.gmail.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Hi Terry,
>
> Thanks for your suggestion. The reason I am trying to configure high
> availability with heartbeat/DRBD is data consistency. I prefer no to have 2
> different sets of data in case one of the syslog server went offline. Do
> you think we might be able to rsync the log folder once in a while to make
> data consistent?
>
> Thanks,
> RB

-- 
Terry Slattery    CCIE# 1026