2.7.2. Licensing model and modes of operation The syslog-ng Premium Edition 7 Administrator Guide
A Log Source Host (LSH) is any host, server, or device (including virtual machines, active or passive networking devices, syslog-ng clients and relays, and so on) that is capable of sending log messages. Log Source Hosts are identified by their IP addresses, so virtual machines and vhosts are separately counted.
The syslog-ng Premium Edition application has three distinct modes of operation: Client, Relay, and Server.
In Client mode syslog-ng Premium Edition collects local logs generated by the host it is running on, and forwards them through a network connection to the central syslog-ng PE server, a relay, or another network destination. If you install the syslog-ng Premium Edition application in Client mode on a host, it counts as a Log Source Host, even if it does not send log messages to a syslog-ng Premium Edition server.
In Relay mode syslog-ng Premium Edition receives logs through the network from Log Source Hosts and forwards them to the central syslog-ng PE server, a relay, or another network destination. If you install the syslog-ng Premium Edition application in Relay mode on a host, it counts as a Log Source Host, even if it does not send log messages to a syslog-ng Premium Edition server.
Relays cannot store the received log messages in local files, except for the log messages of the relay host. Naturally, relays can use disk-based buffering for every message.
In Server mode syslog-ng Premium Edition acts as a central log-collecting server that receives messages through a network connection, and stores them locally, or forwards them to other destinations or external systems (for example, a SIEM or a database). Installing the syslog-ng Premium Edition application in Server mode requires a license file, this license file determines the number of Log Source Hosts that can send log messages to the syslog-ng Premium Edition server.
Note that the number of source hosts is important, not the number of hosts that directly sends messages to syslog-ng Premium Edition: every host that send messages to the server (directly or using a relay) counts as a Log Source Host.
|Client mode||Relay mode||Server mode|
|Collect the local logs of the host||✔||✔||✔|
|Forward local logs over the network||✔||✔||✔|
|Store local messages in local files||✔||✔||✔|
|Receive logs over the network||no||✔||✔|
|Forward received logs over the network||no||✔||✔|
|Store received logs in local files||no||no||✔|
|Forward logs using special destinations (for example, databases)||no||no||✔|
|Requires license file||no||no||✔|
Table 2.1. Modes of operation in syslog-ng PE