Forum Discussion

Wintrode_61162's avatar
Wintrode_61162
Icon for Nimbostratus rankNimbostratus
Oct 03, 2012

UDP Syslog Monitor

I am trying to think of an easy way to monitor the health of ArcSight Collectors listening for UDP Syslog. We have a very high volume syslog environment and want to institute load balancing of the collectors to allow the environment to scale better and to be centralized. We are using a stateless n-path setup as described in the DNS Traffic Management using the BIG-IP Local Traffic Manager white paper (http://www.f5.com/pdf/deployment-gu...ing-dg.pdf). With DNS you can create a nice clean little UDP monitor since you are expecting a response to your query, but in the case of syslog, you get nothing in response.

 

One thought was to just create an external monitor and query the collectors using SNMP and check the status of various services, but this may miss something if we are not looking at everything. Anyone out there doing something similar or have any novel ideas?

 

Thanks --Mike

 

 

config
design

2 Replies

Sort By
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Oct 05, 2012
    If you enable tcp syslog (syslog-ng) you can send the logs via a tcp connection rather than a fire & forget UDP message. Does the ArcSight collector have a tcp option?

     

     

    If you really need UDP then you probably need to combine an ICMP query with a UDP message... ICMP checks the box is up/down. Then the UDP will get nothing back IF the syslog receiver is listening, and SHOULD receive an ICMP port closed message if nothing is listening but the server is up. I'm not sure if a UDP monitor looks for the ICMP coming back if nothing is listening... It might, but I haven't checked. if it doesn't you'll need to do this as an external monitor.

     

     

    H
  • Steven_J__Willi's avatar
    Steven_J__Willi
    Icon for Nimbostratus rankNimbostratus
    Oct 30, 2018

    Did you ever figure this out? I am up against the same challenge at this point with monitoring RADIUS servers.