The syslog-ng Premium Edition application is licensed on a per-host basis: the
syslog-ng server accepts connections only from the number of individual hosts (also
called log source hosts) specified in its license file.
A log source host is a host or network device (including syslog-ng clients and relays)
that sends logs to the syslog-ng server. Log source hosts can be servers, routers,
desktop computers, or other devices capable of sending syslog messages or running
syslog-ng. Log source hosts are identified by their IP addresses, so virtual machines
and vhosts are separately counted. Licenses are available for 5, 10, 25, 50, 100, 150,
200, 250, 300, 500, 750, 1000, and unlimited number of log source hosts.
![[Warning]](./warning.png) |
If the actual IP address of the host differs from the IP address received by looking up its IP address from its hostname in the DNS, the syslog-ng server counts them as two different hosts. The chain_hostnames() option of syslog-ng can interfere
with the way syslog-ng counts the log source hosts, causing syslog-ng to think there
are more hosts logging to the central server. As
chain_hostnames() is a deprecated option, disable it on your
log sources to avoid any problems related to license counting. |
Buying a syslog-ng server license permits you to perform the following:
Install the syslog-ng application in server mode to a single host. This host
acts as the central log server of the network.
Install the syslog-ng application in relay or client mode on host computers.
The total number of hosts permitted to run syslog-ng in relay or client mode is
limited by the syslog-ng server license. The client and relay hosts may use any
operating system supported by syslog-ng. See Section 1.6, “Supported platforms” for details.
Download software updates for a year.
![[Example]](./example.png) |
|
Let's say that you have two facilities (e.g., data centers or server farms), and
you have 80 AIX servers and 20 Microsoft Windows host at Facility 1, and 5 HP-UX
servers and 40 Debian servers at Facility 2. That is 145 hosts altogether.
If you want to collect the log messages of these host to a single
logserver, then you need a syslog-ng PE license that allows you to accept
logs from at least 145 hosts. (In practice this means you have to buy a
license for 150 hosts.) If you want each facility to have its own logserver, and do not want to
have a central server that collects the log messages of both facilities, you
need two separate licenses: a license for 100 hosts at Facility 1, and a
license for at least 45 hosts at Facility 2 (actually you have to buy
license for 50 hosts). -
If you want each facility to have its own local logserver that stores the
logs locally, and also want to have a central logserver that collects every
log message independently from the two local logserver, you need three
licenses: a license for 100 hosts at Facility 1, and a license for at least
45 hosts at Facility 2, and a license for the central logserver. The size of
the license on the central logserver should be 100 (the hosts at Facility 1)
+ 45 (the hosts at Facility 2) + 2 (the two local logservers at each
facility) = 147 — practically thats another 150-host license.
![[Note]](./note.png) |
If, for example, the 40 Debian servers at Facility 2 are each running
3 virtual hosts, then the total number of hosts at Facility 2 is 125,
and the license sizes should be calculated accordingly. |
|
The syslog-ng Open Source Edition application is distributed under version 2 of the
GNU General Public License. See Appendix 3, GNU General Public License for details.
