I am trying to think of an easy way to monitor the health of ArcSight Collectors listening for UDP Syslog. We have a very high volume syslog environment and want to institute load balancing of the collectors to allow the environment to scale better and to be centralized. We are using a stateless n-path setup as described in the DNS Traffic Management using the BIG-IP Local Traffic Manager white paper (http://www.f5.com/pdf/deployment-gu...ing-dg.pdf). With DNS you can create a nice clean little UDP monitor since you are expecting a response to your query, but in the case of syslog, you get nothing in response.
One thought was to just create an external monitor and query the collectors using SNMP and check the status of various services, but this may miss something if we are not looking at everything. Anyone out there doing something similar or have any novel ideas?
Did you ever figure this out? I am up against the same challenge at this point with monitoring RADIUS servers.