NetBSD-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Syslog NG reporting to logserver cluster?


On Aug 24, 2009, at 6:40 AM, Dirk H. Schulz wrote:
- is it possibe to configure a second remote rsyslog server to report to ONLY in case the primary syslog server is unreachable?

If you can configure IP-level redundancy via CARP or via something like load-balancer hardware from ServerIron/NetScaler/etc, sure. You're almost sure to have some network traffic fall through the cracks during the keepalive checking interval if a failover happens, but failing over should be a rare case.

However, heavily loaded syslog servers will quite happy drop some fraction of UDP traffic anyway from time to time, so this isn't too unusual.

- is it possible to configure buffers (RAM, disk) where undeliverable messages are buffered until they can be delivered?

Any hint or help is appreciated.

Logging via a local filesystem domain socket (ie, /var/run/log or similar) is much more reliable that logging over remote network sockets. You might find adjusting sysctl kern.ipc.somaxconn and/or upping the second argument to listen() call in your syslogd will help.


Home | Main Index | Thread Index | Old Index