Help with adding Syslog collectors

Question

Hello I have a question based on syslog traffic, we currently have a VIP in Stateless mode that is forwarding syslog traffic from our infrastructure devices (servers, switches, routers etc) to syslog collectors that are in a pool. There is a desire to add 2 new destinations (LCP servers) where copies of the syslogs will be sent to, how can this be accomplished. The current pool is set up for load balancing via round robin but we would like the same syslog to be sent to 4 destinations:
syslog collector server 1 
syslog collector server 2
LCP collector 1
LCP collector 2&nbsp;
Is it as easy as adding the two new servers into the current pool? Please let me know appreciate the support.&nbsp;

leonardo_souza3 · Answer

I did not understand what is the end goal.&nbsp;
If just add 2 new servers and do round robin, yes, just add the 2 new servers to the pool.&nbsp;
If you want to duplicate packets, you can use the clone pool option in the virtual server setup.
However, that will only clone once, not 3 times.&nbsp;
If you need 3 times, I guess you need iRules to do that.&nbsp;

thomson_thomas · Answer

Thanks Leonardo the intention is to send the same traffic to 4 different destinations/servers&nbsp;

leonardo_souza3 · Answer

The second iRule in this code, should do what you need:&nbsp;
https://devcentral.f5.com/codeshare?sid=563&nbsp;

thomson_thomas · Answer

If I used the stateless virtual server type would this accomplish the same thing? From what I have been reading it is used to forward traffic to syslog collectors.&nbsp;

leonardo_souza3 · Answer

https://support.f5.com/csp/article/K13675&nbsp;
By default, even for UDP traffic, F5 creates a connection in the connection table to track the connection.&nbsp;
In some cases you don't want that, so you can use the stateless virtual server.&nbsp;
That is similar to use idle timeout immediate in the UDP profile, as that removes the connection immediately after is added to the table.&nbsp;
However, like other virtual server types, it just sends the traffic once to the pool member.&nbsp;
So, it does not help with your requirement.&nbsp;

Forum Discussion

Help with adding Syslog collectors

7 Replies

Recent Discussions

google-visualization-issues

The best load balance method on this scenario?

SMS server with BIGIP

Geo Fence in ASM through irule for URI

Client certificate Authentication - open multiple tabs

Related Content

Tcp syslog

Getting Started with BIG-IP Next: Adding Instances to Central Manager

remote SYSlog setup

LTM 9.4.2+: Custom Syslog Configuration

BIG-IP to Process TLS Syslog Traffic