Highly Available (Double) Data-Source (Syslog)

[pinVie]

Hi all,

I'm currently experiencing this challenge.

At a customer site we have two identical syslog servers receiving the same data from the same sources. For some reasons it might be that a data source decides to only send it's data to one of the two syslog servers (as it happened yesterday). Since currently only one of the two syslog servers has a forwarder installed, we miss data that is only sent to the other syslog server. But if I install the forwarder on both syslog servers I would get most of the data twice (if the inputs.conf is the same).

How are such situations handled properly? Is there any possibility to only index data once although it is present on both syslog servers?

Thank you !

[esix_splunk]

There's no easy way to deal with this. Most of the syslog devices out there are very rudimentary in their processing of failover addresses or dual streaming of UDP / TCP syslog streams..

Typically we wouldnt recommend active / active, because, as you mention, you will get double usage. Also, syslog over TCP is also preferred, but mostly not feasible..

Typically ways around this are to put a load balancer in front of the syslog servers, and have a VIP serving up to both of these syslog servers. This will allow for HA/failover, while still getting Splunk to work. In this scenario, you would potentially have those syslog feeds feeding into both devices, but you would never have duplicate feeds, as only one stream to each server (through the VIP) would be active.

[pinVie]

Thank you for this information - deep inside me I knew that there is no easy solution 😞
We definitely do not have the possibility to change the architecture of the syslog servers since they are used for other purpose as well, so I will have to find some "splunky solution". I fear that the solution will involve several manual tasks.

Thx again.