Forum Discussion
NimbostratusUDP Syslog Monitor
I am trying to think of an easy way to monitor the health of ArcSight Collectors listening for UDP Syslog. We have a very high volume syslog environment and want to institute load balancing of the collectors to allow the environment to scale better and to be centralized. We are using a stateless n-path setup as described in the DNS Traffic Management using the BIG-IP Local Traffic Manager white paper (http://www.f5.com/pdf/deployment-gu...ing-dg.pdf). With DNS you can create a nice clean little UDP monitor since you are expecting a response to your query, but in the case of syslog, you get nothing in response.
One thought was to just create an external monitor and query the collectors using SNMP and check the status of various services, but this may miss something if we are not looking at everything. Anyone out there doing something similar or have any novel ideas?
Thanks --Mike
2 Replies
HamishCirrocumulus
If you enable tcp syslog (syslog-ng) you can send the logs via a tcp connection rather than a fire & forget UDP message. Does the ArcSight collector have a tcp option?
If you really need UDP then you probably need to combine an ICMP query with a UDP message... ICMP checks the box is up/down. Then the UDP will get nothing back IF the syslog receiver is listening, and SHOULD receive an ICMP port closed message if nothing is listening but the server is up. I'm not sure if a UDP monitor looks for the ICMP coming back if nothing is listening... It might, but I haven't checked. if it doesn't you'll need to do this as an external monitor.
H
Steven_J__WilliDid you ever figure this out? I am up against the same challenge at this point with monitoring RADIUS servers.
