ANYCAST redundancy with syslog

[sladei]

Is anyone using Anycast technology to provide syslog redundancy for the forwarders? Anycast idea much like that used for DNS...

[kogane · Accepted solution]

Yes, using Quagga + ospfd. Logs get sent to an anycast syslog server IP, which routes to an actual syslog server, which has the Splunk forwarder running on it.

[eegilbert]

Gotcha, I think I know where to go with this now, thank you!

[kogane]

We just have syslog on our hosts configured to send data to "sysloghost", which resolves to an anycast IP. The actual syslog servers are the ones running quagga/ospfd.

[eegilbert]

Kogane, could you please elaborate a little on your post? I'm aware Quagga is a fork of Zebra, how did you config syslog to forward to anycast?