Syslog

You can load balance syslog traffic using log backends.

A log backend is a backend that sends log messages to the log servers. To define a backend as a log backend, specify mode log.

Use the balance directive to specify the load balancing algorithm for a log backend. You can specify one of roundrobin, random, log-hash, or sticky.

List the log servers that should receive log messages.

Log backends support common backend and server features but do not support the HTTP and TCP related features.

To tune the buffer size of the implicit ring associated with the log backend, use the log-bufsize setting. A larger value for this setting may increase memory usage but can help to prevent loss of log messages.

One way to use a log backend is by combining it with the native log relaying infrastructure provided by the log-forward directive.

UDP Jump to heading #

To load balance syslog over UDP, the log-forward section must bind using the dgram-bind directive. In the backend section, the log server address must be prefixed with the udp@ string.

Example:

haproxy
log-forward syslog
  dgram-bind :5144
  log backend@mylog-rrb local0
backend mylog-rrb
  mode log
  balance roundrobin
  server log1 udp@172.31.42.75:3514
  server log2 udp@172.31.41.76:3514

haproxy
log-forward syslog
  dgram-bind :5144
  log backend@mylog-rrb local0
backend mylog-rrb
  mode log
  balance roundrobin
  server log1 udp@172.31.42.75:3514
  server log2 udp@172.31.41.76:3514

For this example, configure remote syslog servers to expect logs with the facility code local0.

There is no way to enable a health check for a UDP syslog service. Instead, check a TCP port on the server or configure agent checks.

TCP Jump to heading #

Load balancing syslog over TCP is more reliable than UDP and should work well for the majority of users. However, its performance is generally lower due to extra copies and queuing costs.

To load balance syslog over TCP, the log-forward section must bind using the bind directive.

Example:

haproxy
log-forward syslog
  bind :5144
  log backend@mylog-rrb local0
backend mylog-rrb
  mode log
  balance roundrobin
  server log1 172.31.42.75:3514
  server log2 172.31.41.76:3514

haproxy
log-forward syslog
  bind :5144
  log backend@mylog-rrb local0
backend mylog-rrb
  mode log
  balance roundrobin
  server log1 172.31.42.75:3514
  server log2 172.31.41.76:3514

For this example, configure remote syslog servers to expect logs with the facility code local0.

You can enable health checks for the log servers in a TCP syslog service.