Is there any risk in load balancing universal forwarder to an intermediate forwarder using a dedicated load balancer?

[AlexCUbisoft]

Hello!

Our setup consists of Universal Forwarders sending logs through a load balancer to Intermediate Forwarders then they end up in our indexers. The Intermediate forwarders send logs directly to the indexers, meaning, they have the indexers directly in their config.

I've read in a thread (https://answers.splunk.com/answers/230399/is-there-any-risk-in-load-balancing-universal-forw.html) thats there's a risk when using a load balancer between a Universal Forwarders and the indexers.

It's not our use case, but I was wondering is it a risk when using a loead balancer between Universal Forwarders and Intermediate forwarders?

Thanks a lot!
ciao
Alex

[Lucas_K]

Load balancing via a load balance such as an F5 will expose you to the issue of persistent connections generated from the upstream forwarder side. You will end up with most/all your connections going to a single intermediate regardless of the number that you have in your load balancing pool.

To counter this use multiple vip addresses and use atleast 2 destinations in each of the upstream F5 clients outputs.conf.

This way the data stream is broken and the load balancer will have a chance to redirect the traffic to another machine.

[somesoni2]

The same risk applies in your use-case as well. When data is forwarded directly from UF to Indexers, Indexer does the event processing. If an Intermediate Fwd is involved (UF to Int Fwd to Indexer) , the event processing roles is performed by Intermediate Fwd and if you're setting up an external load balancer between UF and Int Fwd, the apart from risking the event processing being broken, you'd add more delay/limits (if there will be limits on LB as well on number of reqs etc).