For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Aurus_345829's avatar
Aurus_345829
Icon for Nimbostratus rankNimbostratus
Jan 08, 2018

Problem with balancing rsyslog messages?

Hello, everybody,   I am sending messages to F5 with Rsyslog, so that it balances the messages between 3 servers that are listening on the same port.   The problem I find is that almost all mes...
application delivery
BIG-IP
cloud
Lee_Sutcliffe's avatar
Lee_Sutcliffe
Icon for Nacreous rankNacreous
Jan 08, 2018

Hello,

 

Assuming you are sending as UDP and not TCP, This is the nature of UDP, it is a 'fire and forget protocol' F5 treats a connection as from the same IP address and port. This behavior can result in apparent, unequal load balancing. If you want to load balance UDP packets, you need to use a UDP Profile with the datagram LB option selected:

 

https://support.f5.com/csp/article/K3605

 

TCP connections will persist to a single pool member if you have a persistence profile, otherwise each connection will load balance to other pool members depending on the configured load blancing method.

 

I would advise configuring your syslogging servers to send as UDP and use an appropriate UDP profile on the virtual server rather than TCP, as this is much more efficient as TCP ACKs are not send back and forth.

 

Lee