syslog-ng documentation

Your main source of knowledge

The syslog-ng product family has an extensive documentation, covering everything from how to install a product to the most complex configuration and settings descriptions. If you cannot find an answer to your question, try the mailing list - our community is always eager to help.

syslog-ng Premium Edition

Contents

2.7.3. Licensing examples The syslog-ng Premium Edition 7 Administrator Guide

Example 2.1. A simple example

Scenario: 

  • You want to install syslog-ng PE in server mode on a log server.

  • 45 servers with syslog-ng PE installed in client mode send logs to the syslog-ng PE log server.

  • 45 networks devices without syslog-ng PE installed send logs to the syslog-ng PE log server.

License requirements: You need a syslog-ng Premium Edition license for at least 100 Log Source Host (LSH) as there are 90 LSHs (45+45=90) in this scenario.

Example 2.2. High Availability (HA) cluster

Scenario: 

  • You want to install syslog-ng PE in server mode on two hosts that run as an active-passive high-availability cluster.

  • 45 servers with syslog-ng PE installed in client mode send logs to the syslog-ng PE log server.

  • 45 networks devices without syslog-ng PE installed send logs to the syslog-ng PE log server.

License requirements: You need a syslog-ng Premium Edition license for at least 100 Log Source Host (LSH) as there are 90 LSHs (45+45=90) in this scenario. You also need a High Availability (HA) license for the passive log server.

Example 2.3. Using alternative log servers with syslog-ng PE clients

Scenario: 

  • You want to install syslog-ng PE in server mode on a log server.

  • 45 servers with syslog-ng PE installed in client mode send logs to the syslog-ng PE log server.

  • 45 networks devices without syslog-ng PE installed send logs to the syslog-ng PE log server.

  • 100 servers with syslog-ng PE installed send log messages to a log server without syslog-ng PE installed.

License requirements: You need a syslog-ng Premium Edition license for at least 200 LSHs as there are 190 LSHs (45+45 that send logs to a syslog-ng PE log server, and another 100 that run syslog-ng PE, 45+45+100=190) in this scenario.

Example 2.4. Using syslog-ng PE relays

Scenario: 

  • You want to install syslog-ng PE in server mode on a log server.

  • 45 servers with syslog-ng PE installed in client mode send logs directly to the syslog-ng PE log server.

  • 5 servers with syslog-ng PE installed in relay mode send logs to the syslog-ng PE log server.

  • Every syslog-ng PE relay receives logs from 9 networks devices without syslog-ng PE installed (a total of 45 devices).

  • 100 servers with syslog-ng PE installed send log messages to a log server without syslog-ng PE installed.

License requirements: You need syslog-ng Premium Edition license for at least 200 LSH as there are 195 LSHs (45+5+(5*9)+100=195) in this scenario.

Example 2.5. Multiple facilities

You have two facilities (for example data centers or server farms). Facility 1 has 75 AIX servers and 20 Microsoft Windows hosts, Facility 2 has 5 HP-UX servers and 40 Debian servers. That is 140 hosts altogether.

Note

If, for example, the 40 Debian servers at Facility 2 are each running 3 virtual hosts, then the total number of hosts at Facility 2 is 125, and the license sizes in the following examples should be calculated accordingly.

  • Scenario: The log messages are collected to a single, central syslog-ng PE log server.

    License requirements: You need a syslog-ng Premium Edition license for 150 LSH as there are 140 LSHs (75+20+5+40) in this scenario.

  • Scenario: Each facility has its own syslog-ng PE log server, and there is no central log server.

    License requirements: You need two separate licenses: a license for at least 95 LSHs (75+20) at Facility 1, and a license for at least 45 LSHs (5+40) at Facility 2. You need a license for 100 LSHs at Facility 1, and a license for 50 LSHs at Facility 2.

  • Scenario: The log messages are collected to a single, central syslog-ng PE log server. Facility 1 and 2 each have a syslog-ng PE relay that forwards the log messages to the central syslog-ng PE log server.

    License requirements: You need a syslog-ng Premium Edition license for 150 LSH as there are 142 LSHs (1+75+20+1+5+40) in this scenario (since the relays are also counted as an LSH).

  • Scenario: Each facility to has its own local syslog-ng PE log server, and there is also a central syslog-ng PE log server that collects every log message independently from the two local log servers.

    License requirements: You need three separate licenses. A syslog-ng Premium Edition a license for at least 95 LSHs (75+20) at Facility 1, a license for at least 45 LSHs (5+40) at Facility 2, and also a license for at least 147 LSHs for the central syslog-ng Premium Edition log server (assuming that you want to collect the logs of the local log servers as well).