Hello all.


I'm planning on setting up rsyslog servers (i.e. loghosts) to store syslog messages from the various RHEL clients in the network. So far I have one "master" server, and one relay server who forwards syslog messages to the master server. The clients log either directly to the master, or to the relay server. In other words, this:

Syslog clients ==> Relay rsyslog server ==> Master rsyslog server <== Syslog clients

It's possible to define failover behavior on the client side, either:
Try one rsyslog server before spooling the messages
Try two or more rsyslog servers before spooling the messages
In the latter scenario one will need multiple failover rsyslog servers. But since the clients are able to spool the messages, and forward them as soon as the rsyslog server comes back up, I'm thinking that one rsyslog server (one relay server and one master server, that is) will suffice. As long as the messages are just temporarily stored locally, no messages should be lost.

Has anyone set up rsyslog (or other syslog-implementations) with failover functionality, and would like to comment on these alternatives?

Furhtermore, our RHEL clients are currently running sysklogd, so if there is some way of setting up failover syslog server without having to upgrade to rsyslog I'd appreciate a howto on this. I'm don't think this is a likely approach, since TCP (as is supported in the rsyslog implementation) seems like the best alternative when setting up failover.

Regards,
kenneho


PS. I posted this question on the Red Hat mailing list a few days ago, but since I didn't get any replies there I'm posting it here too.

I would suggest using some level of clustering within your servers, and not push anything to the client at all. Make the clients log UDP to one ip, and just have confidence that that IP will be failed between servers if need be.