Load Balancing SYSLOG Servers

Last published : Sep 22, 2026
The NetScaler appliance send its SYSLOG events and messages to all the configured external log servers. This results in storing redundant messages and makes monitoring difficult for system administrators. To address this issue, the NetScaler appliance offers load balancing algorithms that can load balance the SYSLOG messages among the external log servers for better maintenance and performance. The supported load balancing algorithms include RoundRobin, LeastBandwidth, CustomLoad, LeastConnection, LeastPackets, and AuditlogHash.
Load balancing of SYSLOG servers using the command line interface
At the command prompt, type:
Add a service and specify the service type as SYSLOGTCP or SYSLOGUDP.
add service <name>(<IP> | <serverName>) <serviceType (SYSLOGTCP | SYSLOGUDP)> <port>
Add a load balancing virtual server, specify the service type as SYSLOGTCP or SYSLOGTCP, and load balancing method as AUDITLOGHASH.
add lb vserver <name> <serviceType (SYSLOGTCP | SYSLOGUDP)> [-lbMethod <AUDITLOGHASH>]
Bind the service to the load balancing virtual server.
bind lb vserver <name> <serviceName>
  1. Add a SYSLOG action and specify the load balancing server name that has SYSLOGTCP or SYSLOGUDP as service type.
add syslogaction <name> <serverIP> [-lbVserverName <string>] [-logLevel <logLevel>]
Add a SYSLOG policy by specifying the rule and action.
add syslogpolicy <name> <rule> <action>
Bind the SYSLOG policy to the system global for the policy to take effect.
bind system global <policyName>
Related information

Load balancing of SYSLOG servers using the configuration utility

  1. Add a service and specify the service type as SYSLOGTCP or SYSLOGUDP.
    Navigate to Traffic Management > Services, click Add and select SYLOGTCP or SYSLOGUDP as protocol.
  2. Add a load balancing virtual server, specify the service type as SYSLOGTCP or SYSLOGTCP, and load balancing method as AUDITLOGHASH.
    Navigate to Traffic Management > Virtual Servers, click Add and select SYLOGTCP or SYSLOGUDP as protocol.
  3. Bing the service to the load balancing virtual server to the service.
    Bing the service to the load balancing virtual server.
    Navigate to Traffic Management > Virtual Servers, select a virtual server and then selectAUDITLOGHASH in the Load Balancing Method.
  4. Add a SYSLOG action and specify the load balancing server name that has SYSLOGTCP or SYSLOGUDP as service type.
    Navigate to System > Auditing, click Servers and add a server by selecting LB Vserver option inServers.
  5. Add a SYSLOG policy by specifying the rule and action.
    Navigate to System > Syslog, click Policies and add a SYSLOG policy.
  6. Bind the SYSLOG policy to the system global for the policy to take effect.
    Navigate to System > Syslog, select a SYSLOG policy and click Action, and then click Global Bindings and bind the policy to system global.
Example:
The following configuration specifies load balance of SYSLOG messages among the external log servers using the AUDITLOGHASH as load balancing method. The NetScaler appliance generates SYSLOG events and messages that are load balanced amongst the services, service1, service2, and service 3.
add service service1 192.0.2.10 SYSLOGUDP 514

add service service2 192.0.2.11 SYSLOGUDP 514

add service service3 192.0.2.11 SYSLOGUDP 514

add lb vserver lbvserver1 SYSLOGUDP -lbMethod AUDITLOGHASH

bind lb vserver lbvserver1 service1

bind lb vserver lbvserver1 service2

bind lb vserver lbvserver1 service3

add syslogaction sysaction1 -lbVserverName lbvserver1 -logLevel All

add syslogpolicy syspol1 ns_true sysaction1

bind system global syspol1
Limitations:
The NetScaler appliance does not support an external load balancing virtual server load balancing the SYSLOG messages among the log servers.