Hey Chris, What flavor of linux will you be putting syslog-ng on? Be sure the syslog-ng you install can handle multi-threading of its processes, so version 3.0 or newer I believe, otherwise it will eat up all of 1 CPU and could most certainly lose logs then if you have a lot of traffic going through haproxy.
We have it setup for one of our customers now, actually I just finished setting it up four days ago and I have syslog-ng splitting out logs per hour. I don't really see much in the way of missing logs, if anything they now have more information than they were getting for the visits to their site from Google Analytics. But just as an idea, using "option httplog clf" in the listen section for mode http, yesterday I receiving around 12G of logs from a single haproxy box while today they are at 4.9G and the day isn't over yet. So today may end up around 10G as the west coast is now getting off of work. And the clf option sends through less data than the normal option httplog so the amount of data is a bit lower than if you log normal logs from haproxy. Joe On Thu, Jan 12, 2012 at 7:03 PM, Chris Miller <[email protected]>wrote: > ** > On 1/12/2012 3:54 PM, Joseph Hardeman wrote: > > Hi Chris, > > If you have a spare nic, you can set this to a different subnet from the > other interfaces and set one on a syslog server, then in the global section > of haproxy setup the logging section, for example: > > log 192.168.5.5:514 local6 > > Make sure your syslog-ng is set for tcp and udp on 514, then you can use > filters to split out the different logs based on receiving servers name in > the message in syslog-ng. > > > This was my thought, I'm just concerned about how syslog-ng will handle > the traffic, as well as any related packet loss since syslog is all udp. > Sounds like you've implemented this before, has the above been an issue? > > Regards, > Chris > > Chris Miller > President - Rocket Scientist > ScratchSpace Inc.(831) 621-7928http://www.scratchspace.com > >
