cancel
Showing results for 
Search instead for 
Did you mean: 

Allow Load Balancing of Syslog Messages

Allow Load Balancing of Syslog Messages

I would like if we could load balance incoming syslog messages using something like an F5 load balancer. It appears that this is currently possible with NTA (Can Netflow traffic be load balanced with an F5? ), but support has advised that this is not currently possible with LM. This would be extremely useful for environments with multiple polling engines, this way you can just point all devices to the VIP instead of needing to configure different syslog destinations depending on polling engine. It is also helpful to reduce workload in case we need to move nodes between polling engines.

5 Comments
Level 12

I'm assuming when you say LM your referring to Log Analyzer, correct? 

I know it works with SAM 6.8 & NPM 12.4, since we're currently doing that for all 8 APE's and the PPE. I assumed it would work with the latest releases, but now you've got me worried.

Level 8

Yeah, I wrote this before Log Manager was rebranded to Log Analyzer. We were on I believe version 1.1 when I contacted support and they informed me that I would need to post a feature request, since it does not support load balancing the incoming log messages. I haven't noticed any updates regarding this in the release notes for newer versions.

Thanks for highlighting this.

I was under the impression that with Log Viewer/Log Analyzer, we can send syslog messages to any of the APE servers (regardless which one is monitoring a source device).

I cannot imagine having 100 APEs and maintaining 100 syslog destination IPs for each network device.

I think I will need to test it in the labs

Hi vangesseld

I have checked it in my labs and I can confirm that Log Viewer/Log Analyzer is able to receive Syslog/Trap messages from any APEs and correlate it.

My test involved Cisco router "Router1" being monitored via Main Poller, which was sending syslog messages to APE. I was able to see each and every message via Web Interface.

(Orion Platform 2019.4 HF3)

So this is already supported, but maybe it is not official

Kind regards,

Marcin.

Community Manager
Community Manager
Status changed to: Open for Voting