Getting Data In

ANYCAST redundancy with syslog

sladei
Engager

Is anyone using Anycast technology to provide syslog redundancy for the forwarders? Anycast idea much like that used for DNS...

1 Solution

kogane
Path Finder

Yes, using Quagga + ospfd. Logs get sent to an anycast syslog server IP, which routes to an actual syslog server, which has the Splunk forwarder running on it.

View solution in original post

kogane
Path Finder

Yes, using Quagga + ospfd. Logs get sent to an anycast syslog server IP, which routes to an actual syslog server, which has the Splunk forwarder running on it.

eegilbert
Explorer

Gotcha, I think I know where to go with this now, thank you!

0 Karma

kogane
Path Finder

We just have syslog on our hosts configured to send data to "sysloghost", which resolves to an anycast IP. The actual syslog servers are the ones running quagga/ospfd.

0 Karma

eegilbert
Explorer

Kogane, could you please elaborate a little on your post? I'm aware Quagga is a fork of Zebra, how did you config syslog to forward to anycast?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...