Should we send ASA logs to 2 universal forwarders?

[FPERVIL]

I am wondering if it makes sense to send logs from a network device to 2 separate machines that have universal forwarders.  I'm new to my company and am trying to understand why this was implemented and what would be the best practice.  I would assume this was done for redundancy purposes.  Please advise as to what the best practice should be.

[woodcock]

I wouldn't have done it that way but this is probably setup as active/standby for UF.  Send data to 2 servers, and have them monitor one another.  If the standby detects that the active is gone, assume active status and start forwarding.  When the was-active comes back and sees the other server is active, assume standby status.

[gcusello]

Hi @FPERVIL,

as you well know, you can take syslogs only when sent, and you lose them if you don't catch.

So you need two receivers to take logs, but to avoid duplication it's a best practice to configure a Load Balancer with two Universal Forwarders with rsyslog or syslog-ng server to receive syslogs.

In this way the load Balancer distributes traffic during normal activity and manages failures.

If you haven't a Load Balancer, you can configure your DNS to associate a logical address to two IP adresses; this workaround has two issues: at first it takes some time to understand when one system is down, so you loose some syslogs, then not all the network appliances accept a dns name.

Ciao.

Giuseppe