In order to use a load-balancer effectively with Syslog-ng stickiness needs to be disabled in the load-balancer configuration.
Please consult with the team responsible for the on-prem load-balancer to ensure the configuration does not have stickiness enabled.
Also, you may see this problem if you are attempting to use a DNS-based load balancer. Syslog-ng will only resolve destination hostnames when the connection is first opened.
*NOTE* It is not recommended to use Syslog-ng in front of a load-balancer as load-balancers are made to balance HTTP/HTTPS traffic and not single extended TCP streams. Please consider by-passing all load-balancers or consider using Syslog-ng PE's built in load-balancing configuration to properly ensure logs are received.
See the following KB for more information on load-balancing within Syslog-ng PE:
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center