Hello, I'm currently using rsyslog in the following setup: - a bunch of clients send Syslog messages to a central rsyslog daemon via TCP - right now, the central rsyslog daemon pipes the logs to both a plain text file and an external program. But I guess that's not so relevant
Soon, this central rsyslog would be overwhelmed by the amount of logging from the clients. And I'm looking for a solution to be able to deploy new "central" rsyslog daemons. I thought about using DNS round robin: - configure clients to send logs to a single hostname - once a new "central" rsyslog is added, add it to DNS Disadvantages to this are specific to DNS round-robin: - load is not balanced if "central" servers are not the same - there is a lag due to DNS caching And I guess another solution is to have a script to run after deployment, which will change the rsyslog.conf on all the clients. But that's doesn't seem to be a good idea, especially since there's no way to actually balance load on the aggregators. Only to make some clients to log to one, others to another, etc. Do you have any thoughts on how to solve the problem? _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
