Forum Discussion

cpt_ri_F5's avatar
cpt_ri_F5
Icon for Cirrostratus rankCirrostratus
Jan 27, 2023
Solved

UDP Datagram LB

Hello, To enable fair load balancing between backend servers (5 syslog srv >> F5 >> 2 splunk srv) I created a new udp profile and activated the option : "Datagram LB" : https://support.f5.com/csp/a...
event
  • cpt_ri_F5's avatar
    cpt_ri_F5
    Feb 24, 2023

    hello,

    FYI, I solved this problem with a simple stateless VS: K13675

    Thank you all

CA_Valli's avatar
CA_Valli
Icon for MVP rankMVP
Jan 27, 2023

Where are you checking the stats? F5 or splunk? Also is this a live stat or is is a cumulative counter?

What I wanted to point out is that datagramLB changes load balancing behvior, and while "standard" UDP profile keeps track of UDP connection and forwards all packets of the same connection to the same destination, this is no longer true with DLB -- meaning that if a syslog message is split into multiple UDP packets you might end up with some of them being balanced to one pool member and other packets of the same flow being balanced to the second pool member.

I thought that this could be a possible problem, as one splunk server might not be able to reconstruct the full syslog message due to part of it being sent to the other server -- and possibly discarding/not logging the "incomplete" packets. 

cpt_ri_F5's avatar
cpt_ri_F5
Icon for Cirrostratus rankCirrostratus
Jan 27, 2023

Thank you it's clear

I checked the stats on splunk, cumulative counter (per minute), but it's the same splunk request.

In the splunk graph I see when I change the UDP profile that the number of logs is divided /5 or more

if we can't recover the integrity of the logs, in this case, I don't understand the point of the option "Datagram LB" !

I am interested in another solution to fairly share the logs on the splunk servers

Thanks!