Distributed Systems Administration Utilities User's Guide

Figure 3-2 syslog-ng Log Consolidator Configuration
1. The syslog-ng server reads the incoming log data from the UDP or TCP connected clients.
Note: gray arrows indicate a read operation; black arrows, a write.
2. The grey area is identical to the client configuration in Figure 3-1: “syslog-ng Log-Forwarding
Configuration”. In terms of the local system, syslog-ng acts as a client and processes
locally forwarded syslog messages and clog_tail messages.
3. The syslog-ng server processes all messages and filters them into the appropriate
consolidated log files. In this specific example, the administrator has created a filesystem
named “/clog” to house the consolidated logs. /clog/syslog/ would contain the
consolidated syslog-related file. /clog/packages would contain consolidated package
logs for a Serviceguard cluster.
3.3 Log Consolidation Configuration
The following sections describe how to configure log consolidation servers and log forwarding
clients. Configuring a consolidation server is a multi-step process. The clog_wizard tool vastly
simplifies the configuration process. If you choose not to use the wizard, the manual configuration
steps are also described below.
Configuring Log Consolidation Server in Cross-Subnet Cluster Environments
In a cluster environment, if all the nodes are within the same subnet, then you can configure a
server within that cluster environment as the log consolidation server.
However, in a cross-subnet cluster environment, the log consolidation server must be an external
system, preferably a quorum server, outside the cross-subnet cluster. You can configure a
cross-subnet cluster only as a log forwarding client, with an external system acting as the log
consolidation master server. After you configure an external system as the log consolidation
master server, the cross-subnet cluster nodes can be configured as log forwarding clients.
3.3 Log Consolidation Configuration 45