OpenFlow versus Commercial Load Balancers in a Campus Network

The production network at Arizona State University uses a commercial load balancer for syslog messages from the firewalls at the data center perimeter. The logs are carried in UDP packets and the load balancer divides the load among servers based on the source IP address. This may cause a server to be overwhelmed due to the high incoming data rate, and create log files unequal in size. These logs are processed by splunk, an application for analyzing the massive streams of data generated by IT systems. In a testbed with an OpenFlow switch and three rsyslog servers, fed by a mirror of the firewall rsyslog traffic, we study controllers implementing round-robin, random, and load-based load balancing policies. All policies achieve delivery ratios comparable with the commercial load balancer. When servers fail or go down for maintenance, the load-based policy produces log files the most balanced in size. The results suggest that an OpenFlow load balancer has performance competitive with a commercial load balancer, and can equalize the log file size at servers which improves the efficiency of splunk.