On Wed, 11 Feb 2015, [email protected] wrote:
Is there a way to keep a failover architeture without duplicating logs please ?
unfortunantly no. If you work through exactly what can go wrong here, you will see that there is no way to both ensure all logs are delivered and none are duplicated without the sender tagging each message and the receiver then weeding out duplicates
The problem is that the communications between the two systems is not instantanious, you are using TCP, which will not loose data under normal conditions, but will loose data under failure conditions. RELP adds application level acknowlegements to the process, so that if the sender doesn't get an acknowledgement from the receiving application it will assume the message didn't get through and re-send it. But this means that if something goes wrong that prevents these acknowlegements from getting through, the receiver will thing they have the message, all properly acknowleged, but the sender will thing it never got to the receiver and will re-send it, causing a duplicate.
In cases like this where the software exits without the ability to save any state (kill -9, reboot, server failure, etc) the receiver has no way of saving it's exact state, so when it comes up again it can't know what messages had been received previously, so it can't tell that the messages it's receiveing are the same as ones that it received before the outage.
You should also look into things like pacemaker http://clusterlabs.org/ that will let you have multiple systems share a single IP address and fail it over if one dies. This will allow you to reduce the outage from a system failure/reboot to seconds.
David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
