Getting Data In
Highlighted

ANYCAST redundancy with syslog

Engager

Is anyone using Anycast technology to provide syslog redundancy for the forwarders? Anycast idea much like that used for DNS...

Highlighted

Re: ANYCAST redundancy with syslog

Path Finder

Yes, using Quagga + ospfd. Logs get sent to an anycast syslog server IP, which routes to an actual syslog server, which has the Splunk forwarder running on it.

View solution in original post

Highlighted

Re: ANYCAST redundancy with syslog

Explorer

Kogane, could you please elaborate a little on your post? I'm aware Quagga is a fork of Zebra, how did you config syslog to forward to anycast?

0 Karma
Highlighted

Re: ANYCAST redundancy with syslog

Path Finder

We just have syslog on our hosts configured to send data to "sysloghost", which resolves to an anycast IP. The actual syslog servers are the ones running quagga/ospfd.

0 Karma
Highlighted

Re: ANYCAST redundancy with syslog

Explorer

Gotcha, I think I know where to go with this now, thank you!

0 Karma