About NLS Centralized Architecture

[bennspectrum]

Hi Nagios team,

I have a question about centralized architecture. Assume that there are many nodes in the world, one node one NLS (maybe a NLS cluster). Every nodes use its NLS to manage their logs, and extract "important log" from these logs.

Then I need a NLS called Master NLS, it is responsible for collecting the "important log" from all of the NLS nodes in world.

Could anyone give some suggestions about how to deploy this architecture? The more detailed the better, thank you!!!

擷取.PNG

[hsmith]

I would take a look at outputs inside of logstash. I also have to note that it is not a good idea to have a cluster with the individual nodes being in different geographic locations. I've seen latency make a cluster fail horribly.

[tmcdonald]

NLS is a clustering product by its very nature, so the idea of a "Master" doesn't make sense in this context. Within each cluster there is a master node, but that is only for organizational purposes - each node in the cluster handles a part of the data, processing, storing, collecting, etc. So in this sense, you would need to set up a separate one-node "cluster" and have the other true cluster send data to it. However, this means that this one single "Master" node has no redundancy or failover capability, so if it goes down there is nothing else to pick up the slack.

My suggestion would be to keep them in a cluster (as much as makes sense - geographically varied servers in a single cluster might slow down network operations across the node) and have a dashboard that queries the nodes for whatever you deem important. How far spread out are your nodes geographically? Is there some other network architecture issue that would prevent them all from being in a single cluster?

[bennspectrum]

Thank to tmcdonald and hsmith,

In fact, I am not sure how far between the nodes in the world. My job is design a feasible architecture to attain this requirement.

The suggestion you gave is that to build a huge worldwide NLS cluster to manage all the log from all nodes.

I will note this suggestion and discuss with my coworkers, thank you all again.

[hsmith]

Let us know if you have any further questions.