Getting Data In

syslog redundancy

szrobag
Explorer

Hello,

I'd like to setup active-failover redundancy instead of time based load balancing on heavy forwarder routing syslog to third party system (syslog-ng) Is it possible somehow ?

The main problem if i config syslog routing to both syslog-ng server, and one of them fail, the whole routing process will be stopped on the heavy forwarder as well.

thanks

0 Karma

woodcock
Esteemed Legend

This is usually done on the load-balancer which should be configured with the 2nd server as hot-standby. We have exactly this setup. We have a UF that handles syslog via syslog-ng. We have a HF that handles HEC, DBConnect, etc., and this also runs syslog-ng but we never expect anything to come except in an emergency. We do it this way because HF is exceedingly inefficient and an intermediary, compared to UF, so we always prefer the UF route.

0 Karma

FrankVl
Ultra Champion

Couple of options:

  • some kind of network load balancer in front of the syslog-ng servers that provides the HF with a single, highly available destination, abstracting from which syslog server actually receives the data
  • keepalived (or something similar) on the syslog-ng servers, where the passive server takes over the IP address of the active server when the active server goes down
0 Karma

ipteam
Engager

Thank you guys. As i see splunk has no native support for this scenario....

0 Karma

woodcock
Esteemed Legend

Not true, you can send syslog directly to Indexers but it is not advised and tends to create unacceptible data loss.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...