Hi Folks, I am starting to evaulate Kiwi Syslog Server and one of the main requirements will be how we provision HA (High Availability)
I have seen some posts regarding the use of LB's (Load Balancers) but these posts are pretty old and don't go into that much detail.
I'm hoping that someone can point me in thr right direction.
If we use 2 LB's in a cluster (probably Netscalers) all clients will connect to the LB VIP.
I'm "guessing at this stage" that the LB's will send all trafiic to one of 2 Kiwi Syslog servers (lets call them Kiwi A and Kiwi B where Kiwi A is the current live server)
We are resilient against the loss of a LB (as theye are operating in a HA Cluster)
If we lose Kiwi A, traffic will be redirected to Kiwi B.
Thoughts/Comments
If we lose a LB, we will probably lose syslog records - I don't think its possible to avoid this (even if we use TCP)?
If we lose Kiwi A, syslog records will be redirected to Kiwi B by the LB (again, I think we could lose some syslog records)
If we need old logfiles on Kiwi A (that isn't now available) - I guess we can't unless Kiwi A writes to a CIFS share (that Kiwi B also writes to) ???
If we don't have access to a direct CIFS share, could we use Windows DFS (so that Kiwi A is replicating to Kiwi B and vice-versa) - again, I think we will miss records.
So basically, if we lose Kiwi A, and the LB starts writing to Kiwi B, Kiwi B will have the replicated records (via DFS from Kiwi A)
Kiwi B should pretty much have almost all of the records available (would need to test this against busy input devices)
Before we go down this road and start testing, It would be great if anyone has any information/feedback/comments they could provide.
Many Thanks.