VIP Setup on Heavy Forwarder

[SamHelp]

There are two heavy forwarders at our site.  The current setup is that there is a VIP defined for client server access.

Here is example for IP definitions:

heavy forwarder 1 [10.1.2.11]

heavy forwarder 2 [10.1.2.12]

VIP [10.1.2.10]

When client server wants to forward monitoring data to splunk, it just pointed to the VIP, 10.1.2.10.

However, I could not find the IP [10.1.2.10] on client server and both heavy forwarders by issuing ifconfig OS command.

How was the VIP defined?  There is no load balancer in front of both heavy forwarders.

[SamHelp]

I issued the following command on client server, heading for VIP:

$ ssh splunk@10.1.2.10

#######################################
### pspfwd01 ###
#######################################

******************************************************************
WARNING: To protect the system from unauthorized use and to ensure
that the system is functioning properly, activities on this system
are monitored and recorded and subject to audit. Use of this
system is expressed consent to such monitoring and recording. Any
unauthorized access or use of this Automated Information System is
prohibited and could be subject to criminal and civil penalties.
******************************************************************

splunk@10.1.2.10's password:

Heavy forwarder 1 [pspfwd01 -- 10.1.2.11] replied...

[gcusello]

Hi @SamHelp ,

you don't have any evidence of the LB configuration on the HFs: the clients point to the VIP and the Load Balancer distribute load between the HFs.

Rememeber to configure the LB in transparent Mode to avoid to have as host the hostname of the LB.

I suppose that you're speaking of syslogs or HEC, not Un iversal Forwarders that don't need the LB.

Ciao.

Giuseppe