rsyslog load balancer

[KeishamM]

Hi All,

We have configured rsyslog as such for port 9001 on two rsyslog server. when the UDP port sends directly to server it works. however , we use a F5 load balancer data is not coming. The health rule is configured as UDP but not working. below is the output which i see frequently

Sep 22 11:13:10 default send string
Sep 22 11:13:15 default send string
Sep 22 11:13:15 default send string
Sep 22 11:13:20 default send string
Sep 22 11:13:20 default send string
Sep 22 11:13:25 default send string
Sep 22 11:13:25 default send string

-----

rsyslog configuration

[root@auvlud1prapp62 rsyslog.d]# cat 99-mainframe-port9001.conf
# rsyslog configuration for central logging
# Note: 'rsyslog-central' must be replaced to match your hostname
# 'localhost' is expected to work, but some persistent cases shown that only
# setting to the real value of the host name prevents from logging local log duplicated
# in remote location

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 9001
$ModLoad imudp
$UDPServerRun 9001

# Set the global dynamic file
$template PerHost, "/apps/log/mainframe/mainframe-%$YEAR%-%$MONTH%-%$DAY%.log"

if ($hostname != 'hostname') then ?PerHost
& stop

[thambisetty]

that is message coming from F5 load balancer to check health of port.

you should look at routing when you have configured your syslog servers with F5 for load balancing.

there could be asymmetric routing happening. 

[KeishamM]

How do we verify the routing ?  For routing, the servers are configured to listen to port.

Regards