Distributed Systems Administration Utilities User's Guide

Next, the wizard prompts for which local logs should be consolidated:
Log files that reside on this system can be consolidated.
Would you like to consolidate this system's syslogs? (y/n) [y]:
Answering yes places this log consolidation system’s own local syslog data in the consolidated
log along with the client system's syslog data. To preserve the priority and facility of syslog
entries, UDP local loopback is used, and syslog is configured to also forward entries to its local
UDP port 514. syslog-ng is configured to read from this port. Thus, consolidating this system’s
syslogs allows clients to also connect to this log consolidation server via UDP port 514, even
if TCP transport is specified earlier. If you choose not to consolidate this system’s syslogs, then
choosing a TCP transport earlier will require that all log forwarding clients be configured to use
the TCP transport. The wizard displays a summary of all the configuration choices made by the
administrator:
Summary of Log Consolidation Configuration:
You have chosen to configure hostname as a Log
Consolidation Server.
Logs will be forwarded from the remote consolidation
clients to local port 1776 using the TCP protocol.
The consolidated logs will be stored under directory:
/clog
The following logs from the local system will be
consolidated:
Syslog
If these choices are correct, continue:
Do you want to continue? (y/n) [y]: y
The wizard displays its progress by describing which files are being modified and warns that
Ctrl/C is disabled until configuration is done. For a complete description of the modified files,
refer to “Manually Configuring Log Consolidation” (page 56).
Copying files that will be modified by the wizard to
/var/opt/dsau/root_tmp/clog. These files will be used to
restore the system to its current log consolidation
configuration, in the event of a failure.
Configuring hostname as a log consolidation server.
Creating the /etc/syslog-ng.conf.server configuration
file.
Creating a symbolic link from /etc/syslog-ng.conf to the
/etc/syslog-ng.conf.server configuration file.
Creating /etc/rc.config.d/syslog-ng, the log
consolidation configuration file.
Updating the syslog configuration:
Updating the /etc/rc.config.d/syslogd file to add
-N SYSLOGD_OPTS. This stops syslogd from
listening to UDP port 514.
Updating the /etc/syslog.conf file for UDP local
loopback.
Starting syslogd for the configuration changes to
take effect.
Registering the log consolidation ports in the
/etc/services file.
48 Consolidated Logging