10.2 Design Scenario B
This design scenario features a redundant NOC architecture. For legal compliance reasons, the provider has a requirement for log messages to be sent to and be stored at two different geographical locations. The data center is located at the same site at the primary NOC (London), where the out-of-band management infrastructure, including vRealize Log Insight and vRealize Operations Manager is located. The second NOC is located in Paris where an additional vRealize Log Insight cluster has been provisioned.
The data center houses a single syslog aggregator to forward logs to the remote secondary NOC in Paris. This requires that logs that transverse a public network be secured using SSL.
The service provider has 1350 source devices logging messages and requires two large vRealize Log Insight cluster nodes to meet the ingestion requirements. To allow for a single host failure without causing ingest pipeline congestion on the remaining instances, three nodes will need to be configured to meet the provider’s requirement for syslog application high availability.
Some devices, such as VMware ESXi 4.x, support only a single syslog target. Depending on the provider’s requirements, this might create a new challenge for the design, because syslog messages are dropped if the single syslog target becomes unavailable. One solution to this problem is to utilize a highly available load balancer pair configured with a VIP between two or more syslog servers. This way, if one syslog server is unavailable, the other syslog server can still ingest and process the events.
In this design, each of the two NOCs employs an external load balancer to distribute log messages evenly across the cluster nodes.
Figure 13. Design Scenario B
The following information provides some specific comments about this scenario and accompanying solution design.
Design Quality | Architect Notes |
Redundant vRealize Log Insight appliances. | Provides a HA solution along with meeting the source ingest requirement. |
Hosts are to be configured to forward syslog data to two target addresses. | esxcli system syslog config set --loghost= 'tcp://10.4.0.150:514,tcp://10.5.0.150:514' |
Local syslog data is being transported over TCP to the local NOC. | TCP is the protocol of choice where the service provider requires assurance of message datagram delivery. |
A syslog aggregator is used to convert TCP messages to SSL and then forward them across a secure WAN link to the remote NOC. | The use of a syslog aggregator in this design limits source traffic across the public network to a single address and provides a local target for client syslog configuration. In this design, traffic is also being repackaged from TCP to SSL/TCP to meet the providers’ security requirements. |
