Redundant syslog processing

Configure your firewall device to send logs to a load balancer, then behind this load balancer you will put 2 or more log collectors like Elastic Agent or Logstash for example.

If you use a load balancer like nginx or haproxy and also want redundancy for it you could have 2 or more servers running it and use a virtual ip address with keepalived to change the ip address if some of the servers go down.

1 Like