Multiple syslog collectors with one syslog analyzer

[jklootwijk]

I am planning a LMS 2.5 installation and have a question about the following.

I want to use two syslog servers (for redundancy) and have configured my devices accordingly. I have read that you can use the Remote Syslog Collector from RME to pass on the received syslog messages to a syslog analyzer. Now when a device sends its logs to the two syslog collectors and in turn the collectors pass on the syslog to one and the same syslog analyzer, will these messages appear twice in the reports from the analyzer?

[mfreeman451]

Good luck, I would just use syslog-ng and this:

http://www.linkdown.org/static_syslogngbrowser_en.html

[nhabib]

They would show up once. RME will recognize the messages as dulpicates.

[jklootwijk]

Thank you for your quick reply. This really put things in perspective for me.

[jklootwijk]

I have tested the above, but the syslog messages appear twice for the same device in the syslog reports.

I used the following test setup:

server-1 with CS and RME (DCR master)

server-2 with CS and RSC (DCR slave)

Catalyst 3550 with logging set to server-1 and server-2.

Servers are each others peers, and server-2 is subscribed as a syslog collector on server-1.

Am I forgetting something or is it just not possible?