Hello,
I'd like to setup active-failover redundancy instead of time based load balancing on heavy forwarder routing syslog to third party system (syslog-ng) Is it possible somehow ?
The main problem if i config syslog routing to both syslog-ng server, and one of them fail, the whole routing process will be stopped on the heavy forwarder as well.
thanks
This is usually done on the load-balancer which should be configured with the 2nd server as hot-standby. We have exactly this setup. We have a UF that handles syslog via syslog-ng. We have a HF that handles HEC, DBConnect, etc., and this also runs syslog-ng but we never expect anything to come except in an emergency. We do it this way because HF is exceedingly inefficient and an intermediary, compared to UF, so we always prefer the UF route.
Couple of options:
Thank you guys. As i see splunk has no native support for this scenario....
Not true, you can send syslog directly to Indexers but it is not advised and tends to create unacceptible data loss.