The syslog-ng 3.0 Administrator Guide

Document version: Tenth
Release date: January 8, 2010
Latest version available at the BalaBit Documentation Page

2.15. Licensing

The syslog-ng Premium Edition application is licensed on a per-host basis: the syslog-ng server accepts connections only from the number of individual hosts (also called log source hosts) specified in its license file.

A log source host is a host or network device (including syslog-ng clients and relays) that sends logs to the syslog-ng server. Log source hosts can be servers, routers, desktop computers, or other devices capable of sending syslog messages or running syslog-ng. Log source hosts are identified by their IP addresses, so virtual machines and vhosts are separately counted. Licenses are available for 5, 10, 25, 50, 100, 150, 200, 250, 300, 500, 750, 1000, and unlimited number of log source hosts.

[Warning] Warning

The chain_hostnames() option of syslog-ng can interfere with the way syslog-ng counts the log source hosts, causing syslog-ng to think there are more hosts logging to the central server. As chain_hostnames() is a deprecated option, disable it on your log sources to avoid any problems related to license counting.

Buying a syslog-ng server license permits you to perform the following:

[Example] Example 2.1. Counting log source hosts

Let's say that you have two facilities (e.g., data centers or server farms), and you have 80 AIX servers and 20 Microsoft Windows host at Facility 1, and 5 HP-UX servers and 40 Debian servers at Facility 2. That is 145 hosts altogether.

  • If you want to collect the log messages of these host to a single logserver, then you need a syslog-ng PE license that allows you to accept logs from at least 145 hosts. (In practice this means you have to buy a license for 150 hosts.)

  • If you want each facility to have its own logserver, and do not want to have a central server that collects the log messages of both facilities, you need two separate licenses: a license for 100 hosts at Facility 1, and a license for at least 45 hosts at Facility 2 (actually you have to buy license for 50 hosts).

  • If you want each facility to have its own local logserver that stores the logs locally, and also want to have a central logserver that collects every log message independently from the two local logserver, you need three licenses: a license for 100 hosts at Facility 1, and a license for at least 45 hosts at Facility 2, and a license for the central logserver. The size of the license on the central logserver should be 100 (the hosts at Facility 1) + 45 (the hosts at Facility 2) + 2 (the two local logservers at each facility) = 147 — practically thats another 150-host license.

    [Note] Note

    If, for example, the 40 Debian servers at Facility 2 are each running 3 virtual hosts, then the total number of hosts at Facility 2 is 125, and the license sizes should be calculated accordingly.

The syslog-ng Open Source Edition application is distributed under version 2 of the GNU General Public License. See Appendix 3, GNU General Public License for details.

© 2007-2008 BalaBit IT Security
Please send your comments or documentation bugs to: documentation@balabit.com

Prev  Up  Next
2.14. Using disk-based buffering  Home | Contents  2.16. High availability support