syslog redundancy

[szrobag]

Hello,

I'd like to setup active-failover redundancy instead of time based load balancing on heavy forwarder routing syslog to third party system (syslog-ng) Is it possible somehow ?

The main problem if i config syslog routing to both syslog-ng server, and one of them fail, the whole routing process will be stopped on the heavy forwarder as well.

thanks

[woodcock]

This is usually done on the load-balancer which should be configured with the 2nd server as hot-standby. We have exactly this setup. We have a UF that handles syslog via syslog-ng. We have a HF that handles HEC, DBConnect, etc., and this also runs syslog-ng but we never expect anything to come except in an emergency. We do it this way because HF is exceedingly inefficient and an intermediary, compared to UF, so we always prefer the UF route.

[FrankVl]

Couple of options:

• some kind of network load balancer in front of the syslog-ng servers that provides the HF with a single, highly available destination, abstracting from which syslog server actually receives the data
• keepalived (or something similar) on the syslog-ng servers, where the passive server takes over the IP address of the active server when the active server goes down

[ipteam]

Thank you guys. As i see splunk has no native support for this scenario....

[woodcock]

Not true, you can send syslog directly to Indexers but it is not advised and tends to create unacceptible data loss.