In message <[EMAIL PROTECTED]>, "Brown, James" writes: >>From: Tim Peiffer >>Sent: Tue 8/12/2008 2:07 AM >> >>[...] Anyway, in order to >>have redundant log and event handlers, I would either need to accept >>dual actions, or look for a way of building in master/slave, >>active/active or active/passive members. >> [...] >> Is there a 'best practice' involving redundant SEC hosts, and >>signalling between them? Does anyone have of a working model that I >>could use? > >What I've done in the past is to set up two SEC units (reading syslog) >and have one unit periodically (via. calendar rule) send the other unit a >message through syslog (like a heartbeat message) that created a context >on the receiving system. > >A calendar rule on the receiving system checked every two minutes for the >existence of the context created by the rule for the heartbeat.
Similar to James, I set up two seperate syslog servers. The standby server only processed it's own events, while the primary processed both. Like James the master sent a heartbeat to the standby but in my case an external process manipulated the contexts in the running standby sec. See: http://www.cs/umb/edu/~rouilj/sec/rulesets/01report_myself_only.sr for the ruleset that uses my framework to operate. However, what would be better is the ability to prevent certain actions from occuring as the standby doesn't have all the state of the master in my setup. Not sure how to work around that. Maybe the ability to have context creation/deletion operation work for all actions, but report, spawn etc get suppressed if sec is in a particular mode? However what happens when you do autodiscovery of hosts (e.g. http://www.cs.umb.edu/~rouilj/sec/rulesets/10timestamp.sr) and thus may need spawn and other commands to operate. -- -- rouilj John Rouillard =========================================================================== My employers don't acknowledge my existence much less my opinions. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
