Getting Data In

ANYCAST redundancy with syslog

Engager

Is anyone using Anycast technology to provide syslog redundancy for the forwarders? Anycast idea much like that used for DNS...

1 Solution

Path Finder

Yes, using Quagga + ospfd. Logs get sent to an anycast syslog server IP, which routes to an actual syslog server, which has the Splunk forwarder running on it.

View solution in original post

Path Finder

Yes, using Quagga + ospfd. Logs get sent to an anycast syslog server IP, which routes to an actual syslog server, which has the Splunk forwarder running on it.

View solution in original post

Explorer

Gotcha, I think I know where to go with this now, thank you!

0 Karma

Path Finder

We just have syslog on our hosts configured to send data to "sysloghost", which resolves to an anycast IP. The actual syslog servers are the ones running quagga/ospfd.

0 Karma

Explorer

Kogane, could you please elaborate a little on your post? I'm aware Quagga is a fork of Zebra, how did you config syslog to forward to anycast?

0 Karma