Centralized Logging -- Single Point of Failure?

[David Langenberg]

If you're centralizing your logs via UNIX syslog, then you shouldn't have anything to worry about.  Syslog is a send and forget protocol which works over UDP.  If the log message doesn't make it to the syslog server, the node really doesn't care.  So, I'd recommend using (in addition to the syslog appender) rolling-file-appenders with sensible rotation policies on the nodes themselves to ensure disk doesn't fill up.  If the central log server dies, you'll still have copies of the logs locally.

Dave

--
David Langenberg
Identity & Access Management
The University of Chicago




On May 6, 2013, at 10:26 AM, Nate Klingenstein <ndk at internet2.edu>
 wrote:

> Looking at running a large clustered IdP and considering centralizing the logging of those IdP's based on this:
> 
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProdLogging#IdPProdLogging-CentralizedLogs
> 
> My hesitation is that I'm concerned that this introduces a single point of failure.  If logging is not centralized and e.g. logging for some reason goes haywire on one cluster member, then that node's disk fills and the node dies and falls out of the pool.
> 
> If logging is centralized, then if the server(s) to which logging is performed is down for whatever reason, does that take your entire cluster down?
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net