0

In our applications we traditionally log events locally into the logging files. As our applications are distributed on multiple server instances, searching for particular events are complicated and time consuming. So we decide to introduce GrayLog as centralized logging solution.

All logging events from an applications are now sent to the GrayLog by UDP protocol, which works fine if the network and the GrayLog server are working fine. If something is wrong, log events sent to the GrayLog server are lost and normally you don't even notice. It is still possible to grep logs on servers but on GrayLog you are never sure that you can find all log events.

My question is: How to ensure that every log event will be delivered to the GrayLog server?

1

Have a look at the Graylog Extended Log Format (GELF). It supports TCP, although only for uncompressed data.

You must trade off network bandwidth versus logging reliability and perform some tests of course.

  • I know that I can use TCP and that then reliability is better. But in case that something is wrong with a network or GrayLog server is down for some time, TCP will just block sending those log events and as GELF messages are sending live those would just slow down or stop the application or use a lot of resources if events are sent in other threads. – Tomazz Dec 14 '18 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.