Is it possible to set up a failover mechanism with Syslog-NG opensource edition?

I want that the syslog-ng Daemon logs to a remote Loghost and switches to an other server if the first would go down for some reason...

  • 1
    I would have to play with the final flag to be certain, but I'm fairly sure syslog-ng cannot do this. I would also agree with the behavior, in that handling failover isn't the responsibility of a client (as it relates to general server/client communication, not just syslog). Failover should be handled by the server with a system such as moving a VIP between servers. – Patrick Feb 5 '14 at 13:28

Syslog-ng itself does not do this. However, here are a few ways to achieve high-availability logging, sorted in increasing levels of complexity/cost:

  • Simply adding both servers and always write to both is the easiest one.

  • Have a backup syslog config around with the second servername. Have a cronjob or something to check the local syslog for reports on connection errors to the server and, when one is found, restart syslog with the backup configuration

  • Setting up a haproxy in tcp-mode on your local server, and setting it to use the primary server first and go to the second in case the first fails. Set syslog to log to the local haproxy instance instead of directly to the remote servers

  • Setting up a cluster of log servers with shared disks on a SAN, commercial HA (e.g. Veritas Cluster)... This is expensive; whether it's worth it will depends on how much it will cost you to lose some logs.

| improve this answer | |
  • We followed your first advice, but here is an issue – overexchange Oct 4 '18 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.