Managing Systems and Workgroups: A Guide for HP-UX System Administrators

Configuring a System
Using Distributed Systems Administration Utilities
Chapter 3 215
This causes the syslog-ng consolidator to read the local syslogd’s
UDP messages and send them to syslog-ng on the local TCP port.
Optionally, the destination could be set to be the local consolidation
file directly (destination(d_syslog) in this default template), but
the above configuration sets the consolidation server client
components in the same manner as a remote client. In other words,
when the consolidator is a client of itself, it is configured identically to
remote clients.
If using the UDP protocol or not consolidating the local syslogs of this
cluster, delete the <%UDP_LOOPBACK_SOURCE%> and
<%UDP_LOOPBACK_LOG%> tokens.
b. Replace the <%TYPE%> tokens with either udp or tcp depending on the
desired log transport to support. Note that even when using TCP
clients, UDP clients are also supported, if the consolidation of the
cluster’s local syslogs is configured. There are multiple lines with the
<%TYPE%> token and all must be edited appropriately.
c. For the “source s_syslog_<%TYPE%>” line, replace the <%PORT%>
and <%KEEP_ALIVE%> tokens with appropriate values:
source s_syslog_<%TYPE%> {<%TYPE%>(port(<%PORT%>)<%KEEP_ALIVE%>); };
For TCP, the port needs to be an available TCP port on all cluster
members. See section “Configuring a Log Consolidation Standalone
Server with clog_wizard” on page 192 for a discussion of selecting an
available port. For UDP, use port 514.
<%KEEP_ALIVE%> applies only when selecting TCP as the log
transport. Replace this token with “keep-alive(yes)” which
instructs syslog-ng to keep connections open when it is rereading its
configuration file. If using UDP, delete this token.
d. For the destination d_syslog_<%TYPE%> line, replace the <%IP%>
and <%PORT%> tokens:
destination d_syslog_<%TYPE%> { <%TYPE%>(“<%IP%>” port(<%PORT%>)); };
For example, for TCP:
destination d_syslog_tcp { tcp(“package IP” port(1776)); };
where the <%IP%> is replaced by the clog package IP address or
hostname and the <%PORT%> is replaced by the selected TCP port
number.