Forum Discussion

Aurus_345829's avatar
Aurus_345829
Icon for Nimbostratus rankNimbostratus
Jan 08, 2018

Problem with balancing rsyslog messages?

Hello, everybody,

 

I am sending messages to F5 with Rsyslog, so that it balances the messages between 3 servers that are listening on the same port.

 

The problem I find is that almost all messages go to a single server.

 

I may be wrong but I think that until the tcp session is interrupted, it doesn't swing to another server.

 

Is it possible to configure F5 so that every X minutes or hours, it swings over another of the 3 servers?

 

Thank you

 

1 Reply

  • Hello,

     

    Assuming you are sending as UDP and not TCP, This is the nature of UDP, it is a 'fire and forget protocol' F5 treats a connection as from the same IP address and port. This behavior can result in apparent, unequal load balancing. If you want to load balance UDP packets, you need to use a UDP Profile with the datagram LB option selected:

     

    https://support.f5.com/csp/article/K3605

     

    TCP connections will persist to a single pool member if you have a persistence profile, otherwise each connection will load balance to other pool members depending on the configured load blancing method.

     

    I would advise configuring your syslogging servers to send as UDP and use an appropriate UDP profile on the virtual server rather than TCP, as this is much more efficient as TCP ACKs are not send back and forth.

     

    Lee