The Importance of Syslog Servers

As the old adage goes, it’s not if a drive fails, but when. A modern 3.5” drive rotates from 7200 – 10,000 RPM. If you do the math, that’s approximately 75-104 MPH (120 – 167 KPH)! Meanwhile, the heads glide over the platters on a cushion of air just 3-7 millionths of an inch. When you stop and think about it, it’s a miracle of technology they even work at all!

While it’s true that modern rotating drives have improved quite a bit in reliability over the years, they are still susceptible to failure over time. The same also holds true for solid-state drives, too. Although solid-state drives do not have the same mechanical complexities as rotating drives, they are still susceptible to many other issues, such as write wear. As a matter of fact, current studies have shown no discernable difference in reliability between solid-state and rotating drives within enterprise data centers.

These factors are why having a syslog server is so important. When a drive starts to show signs of failure, an SRX will report what is known as a “raidshield” error. Raidshield errors, along with other important information, get reported to a syslog server. Many syslog servers can even alert users via email or other methods whenever certain types of messages have been recorded.

Early detection and proactive drive replacement greatly reduce your chances of having a catastrophic failure of a RAID based LUN utilizing mirrors or parity. Furthermore, having a record of syslog messages is needed to help with recovery, should a catastrophic LUN failure occur. These messages and timelines are needed for engineering to make any attempts at data recovery in these situations.

For Coraid users with appliances running EthOS, there is the option for a remote syslog monitoring service. With this service, syslog messages are sent via the internet to the Coraid data center. These logs are actively monitored by support engineers who will proactively open support cases with customers should the need arise.

With remote syslog, you would open an outgoing port to send us those messages. Because it is an outgoing port, the connection is secure. The syslog messages do not carry any information about your data, only messages about the health of the SRX environment.