Multiple syslog server support

BMC AMI Datastream and CZASEND support multiple destination syslog servers (subject to memory constraints). You can specify multiple alternative servers by using the ALTERNate parameter in the SERVER-statement. Parameters defined in the SERVER statement are the same for all servers, primary and alternative, including the TRANSport (UDP or TCP) and MAXMSGlen (maximum message length) parameters. The only exception is the PROTOcol parameter, which is individual for each specified server.

Related topic

Planning

Transport protocol and server treatment

The transport protocol that you specify, UDP or TCP,  determines the way that multiple servers are treated.

UDP

BMC AMI Datastream and CZASEND send all syslog messages to all of the specified addresses.

The order of alternative server specifications is not significant.

TCP

If BMC AMI Datastream or CZASEND receives an IP error when communicating with the primary syslog server, it switches to the first alternative, then the second, and so on. BMC AMI Datastream issues console and CZAPRINT messages notifying you that a switch occurred.

The order of alternative server specifications is significant. The first alternative server is alternate 1, the second is alternate 2, and so on. BMC AMI Datastream tries them in that order and validates the connection to each server address on startup. If a connection fails, BMC AMI Datastream tries to connect with the next alternative server in line. All switches between server connections are documented in CZAZOSLG.

If you refresh the parameter file containing your server definitions, BMC AMI Datastream first tries to connect to the server with which it had its last connection, based on the server address and not the server number.

Example

BMC AMI Datastream is connected to alternate 2. You open the parameter file, delete alternate 1 from the file, and then refresh the parameter file. BMC AMI Datastream reconnects to the same server (alternate 2), even though that it is now listed as alternate 1 in the parameter file.

BMC AMI Datastream maintains cumulative statistics for each server address, even if it changes number after you refresh the parameter file.

You can use the CONCURRent parameter in the SERVER statement to connect to both primary and alternative servers at the same time. This is useful if you want to duplicate data across your system. If a connection is inactive, it does not receive any messages produced during its outage window.

For more information, see SERVER-statement.

TCP/IP error recovery

When a syslog protocol TCP/IP error occurs, BMC AMI Datastream cannot determine how many messages were not delivered except for the message it just tried to send (that is usually also not delivered).

BMC AMI Datastream supports the SERVER statement parameter REXMIT(n), where n defaults to 2 and can have any value from 1 through 20 (where 20 is an arbitrary reasonableness check). If BMC AMI Datastream encounters a TCP/IP session failure and starts a new session with an alternative server IP address, it retransmits the same number of preceding messages.

Example

You specify REXMIT(5). If two messages are lost due to a failure, then on the alternative connection you receive the two lost messages preceded by three duplicates (that is, the retransmissions of three messages that were already successfully delivered). If ten messages are lost due to a failure, then five messages are irretrievably lost, but five messages are sent again on the retransmission.


Tip

To prevent duplicates, specify REXMIT(1). If you can tolerate duplicates but want to minimize the number of messages that are lost due to an error, specify REXMIT(20). The default specification, REXMIT(2), is a compromise between the two extremes.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*