splunk-connect-for-syslog icon indicating copy to clipboard operation
splunk-connect-for-syslog copied to clipboard

Documentation conflict regarding load balancers

Open splaarmy opened this issue 1 year ago • 2 comments

Describe the bug SC4S documentation mentions not using load-balancers in a few places, such as https://splunk.github.io/splunk-connect-for-syslog/main/lb/, however on the page linked below seems to list a load-balancer as a prerequisite:

A network load balancer (NLB) configured for round-robin. Note: Special consideration may be required when more advanced products are used. The optimal configuration of the load balancer will round-robin each http POST request (not each connection).

https://splunk.github.io/splunk-connect-for-syslog/main/gettingstarted/getting-started-runtime-configuration/

To Reproduce Steps to reproduce the behavior:

  1. Go to https://splunk.github.io/splunk-connect-for-syslog/main/gettingstarted/getting-started-runtime-configuration
  2. Item in question is currently the second paragraph in the Prerequisite section.

splaarmy avatar Feb 28 '24 14:02 splaarmy

The loadbalancers in this case have different usages.

The loadbalancer that's recommended is the load balancer for balancing the http (HEC) traffic to indexers.

The loadbalancer that's not recommended is the load balancer that's placed infront of the syslog server (SC4S).

fyodorr avatar Mar 22 '24 13:03 fyodorr

We are working on documentation , we will update the sections to make it more clear cc: @mstopa-splunk

rjha-splunk avatar Apr 17 '24 09:04 rjha-splunk

The clarification documentation is merged.

rjha-splunk avatar Jun 26 '24 10:06 rjha-splunk