3

Is it possible to set up a failover mechanism with Syslog-NG opensource edition?

I want that the syslog-ng Daemon logs to a remote Loghost and switches to an other server if the first would go down for some reason...

phemmer
  • 70,657
  • 19
  • 188
  • 223
user2927980
  • 307
  • 1
  • 7
  • 14
  • 1
    I would have to play with the `final` flag to be certain, but I'm fairly sure syslog-ng cannot do this. I would also agree with the behavior, in that handling failover isn't the responsibility of a client (as it relates to general server/client communication, not just syslog). Failover should be handled by the server with a system such as moving a VIP between servers. – phemmer Feb 05 '14 at 13:28

1 Answers1

2

Syslog-ng itself does not do this. However, here are a few ways to achieve high-availability logging, sorted in increasing levels of complexity/cost:

  • Simply adding both servers and always write to both is the easiest one.

  • Have a backup syslog config around with the second servername. Have a cronjob or something to check the local syslog for reports on connection errors to the server and, when one is found, restart syslog with the backup configuration

  • Setting up a haproxy in tcp-mode on your local server, and setting it to use the primary server first and go to the second in case the first fails. Set syslog to log to the local haproxy instance instead of directly to the remote servers

  • Setting up a cluster of log servers with shared disks on a SAN, commercial HA (e.g. Veritas Cluster)... This is expensive; whether it's worth it will depends on how much it will cost you to lose some logs.

Jenny D
  • 13,022
  • 3
  • 38
  • 54
  • We followed your first advice, but here is an [issue](https://unix.stackexchange.com/questions/473290/message-forwarding-with-de-duplication-syslogng) – overexchange Oct 04 '18 at 17:49