questions about NLS's HA

[benhank]

OK. I have two nls servers.
All remote devices that are sending logs have been configured to send logs to NLSserver1.
I understand HOW NLS achieves HA and LB for the cluster.
Here is my question:
Since my devices are setup to only send data to the 1st machine, what is the process that kicks in when machine 1 goes down?

I ask this because I have had to rebuild my 1st machine, and my second one, which has a different IP was getting logs.

[jolson]

So let's say you have 2 Nodes - Node1 and Node2. If all log sources are configured to send logs to Node1, Node1 will load balance across Node1 and Node2 as it sees fit. One day, Node1 explodes and the log data which used to be going to node1 can no longer do so. Those logs will not be received by Node2 - there is no failover mechanism in place for that. I can't speak to your setup - but many people have HAProxy/Round Robin DNS in place to avoid this type of thing from happening.

The logs that you did see may have been from localhost@Node2 - sending itself logs. Does that help answer your question?

[benhank]

lies its all lies! JK yes thanks for clearing that up

[jolson]

No problem. I'll close this thread out. Thanks!

Jesse