topic Re: syslog redundancy in Getting Data In

syslog redundancy

szrobag — Tue, 10 Jul 2018 14:36:44 GMT

Hello,

I'd like to setup active-failover redundancy instead of time based load balancing on heavy forwarder routing syslog to third party system (syslog-ng) Is it possible somehow ?

The main problem if i config syslog routing to both syslog-ng server, and one of them fail, the whole routing process will be stopped on the heavy forwarder as well.

thanks

Re: syslog redundancy

FrankVl — Tue, 10 Jul 2018 15:56:29 GMT

Couple of options:

some kind of network load balancer in front of the syslog-ng servers that provides the HF with a single, highly available destination, abstracting from which syslog server actually receives the data
keepalived (or something similar) on the syslog-ng servers, where the passive server takes over the IP address of the active server when the active server goes down

Re: syslog redundancy

woodcock — Tue, 10 Jul 2018 16:11:49 GMT

This is usually done on the load-balancer which should be configured with the 2nd server as hot-standby. We have exactly this setup. We have a UF that handles syslog via syslog-ng. We have a HF that handles HEC, DBConnect, etc., and this also runs syslog-ng but we never expect anything to come except in an emergency. We do it this way because HF is exceedingly inefficient and an intermediary, compared to UF, so we always prefer the UF route.

Re: syslog redundancy

ipteam — Wed, 11 Jul 2018 08:19:29 GMT

Thank you guys. As i see splunk has no native support for this scenario....

Re: syslog redundancy

woodcock — Wed, 11 Jul 2018 15:24:19 GMT

Not true, you can send syslog directly to Indexers but it is not advised and tends to create unacceptible data loss.