Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

UDP Syslog Monitor

I am trying to think of an easy way to monitor the health of ArcSight Collectors listening for UDP Syslog. We have a very high volume syslog environment and want to institute load balancing of the collectors to allow the environment to scale better and to be centralized. We are using a stateless n-path setup as described in the DNS Traffic Management using the BIG-IP Local Traffic Manager white paper (http://www.f5.com/pdf/deployment-gu...ing-dg.pdf). With DNS you can create a nice clean little UDP monitor since you are expecting a response to your query, but in the case of syslog, you get nothing in response.

One thought was to just create an external monitor and query the collectors using SNMP and check the status of various services, but this may miss something if we are not looking at everything. Anyone out there doing something similar or have any novel ideas?

Thanks --Mike

 

0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
If you enable tcp syslog (syslog-ng) you can send the logs via a tcp connection rather than a fire & forget UDP message. Does the ArcSight collector have a tcp option?

If you really need UDP then you probably need to combine an ICMP query with a UDP message... ICMP checks the box is up/down. Then the UDP will get nothing back IF the syslog receiver is listening, and SHOULD receive an ICMP port closed message if nothing is listening but the server is up. I'm not sure if a UDP monitor looks for the ICMP coming back if nothing is listening... It might, but I haven't checked. if it doesn't you'll need to do this as an external monitor.

H
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Did you ever figure this out? I am up against the same challenge at this point with monitoring RADIUS servers.

0