Well - a very uncomplicated solution would be to log to a local syslog server (any would probably do) and then use the im_file input in nxlog to ship them to your Graylog setup over TCP.
> On 20 Mar 2015, at 05:51, Pete GS <[email protected]> wrote: > > Hi all, > > We're looking at adding message sources into our Graylog setup from a couple > of remote sites. There is the possibility of temporary transit link outages > so sending UDP packets would result in lost messages. Using TCP will counter > this to a certain extent but may result in messages queuing on sources > running NXLog etc. which we would like to avoid. > > I'm think it would be better to set up a message broker at the remote site > and having Graylog subscribe to this to retrieve the messages instead once > the link is available again. > > Does this sound like a sensible idea or is there some better way to achieve > this? > > Any recommendations on a preferred message broker etc.? > > Any clues on how to get NXLog, Syslog, etc. to log to a message broker > instead of to Graylog directly? > > Cheers, Pete > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] > <mailto:[email protected]>. > For more options, visit https://groups.google.com/d/optout > <https://groups.google.com/d/optout>. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
