I have just built a brandy new syslog server. The purpose of this server is to provide a buffer so that instead of sending all syslog traffic directly to my indexers and losing data when I have to restart the indexers for various reasons or the connectivity drops or whatever, all that traffic comes to the syslog server which then gets sent to the indexers. The idea is that this machine would be capable of buffering events if the indexer can't be reached.
So my question is this: Is it best to:
Thanks.
Oh, and IF #1, how many universal forwarders can you have on a single machine?
The first one is the best if your syslog server is not the indexer.
1 . receive remote logs via syslog, write them to a local file/database and then use a universal forwarder to send to indexers
Otherwise option 4.
4 . receive remote logs via syslog, write them to a local file on the indexers and monitor locally.
Thanks.
Using #1.
I'm having a weird issue though. I will post another question to deal with that...
The first one is the best if your syslog server is not the indexer.
1 . receive remote logs via syslog, write them to a local file/database and then use a universal forwarder to send to indexers
Otherwise option 4.
4 . receive remote logs via syslog, write them to a local file on the indexers and monitor locally.