Distributed Systems Administration Utilities User's Guide

added and deleted, the DSAU consolidated logging tools will automatically take the appropriate
configuration actions. Specifically:
• When adding a member to the cluster, the new member is automatically configured to
participate in log consolidation according to the cluster’s configuration. The following files
are automatically configured on the added member:
— /etc/rc.config.d/syslog-ng
— /etc/rc.config.d/syslogd
— /etc/syslog.conf
— /etc/syslog-ng.conf.client, /etc/syslog-ng.conf.server, and the /etc/
syslog-ng.conf symbolic link
— /etc/services
• When deleting a member from a cluster:
— The member is still configured as a log-forwarding client and will continue to forward
syslog messages to the cluster if that option had been chosen during the initial run of
the clog_wizard. If the system should no longer forward log messages to the cluster,
rerun the wizard to configure the system to forward to a different consolidator, or
disable log consolidation entirely. Refer to “Disabling Log Consolidation” (page 75)
for additional information.
— The package logs on the deleted member are still monitored until a reboot. Since this
member is no longer part of the cluster, the package logs will not be active.
• When adding or deleting a package, the following automated actions occur:
— The package is added to or deleted from /etc/syslog-ng.conf.server cluster-wide.
There is a reserved section of these files dedicated for use by the DSAU tools. The
configuration stanzas added in this section direct syslog-ng to filter package log
messages into the appropriate consolidated package logs.
— The clog_tail log monitor adds or deletes the package log file from its list of files to
monitor.
3.3.1.5 Minimizing Message Loss During Failover
When there is a failure on the adoptive node, it takes a finite amount of time for the clog package
to fail over to another cluster member. The longer this failover time, the more likely that messages
could be lost from the consolidated log. Use the following guidelines to minimize message loss
during failover.
• Configure clients to use the TCP transport instead of the UDP transport. UDP messages will
be lost unconditionally when the package is down. The TCP protocol contains retry
mechanisms, congestion control, and so on, that help minimize message loss.
• syslog-ng can buffer TCP messages on the client side. The number of messages buffered
is controlled by the syslog-ng log_fifo_size setting. This sets an upper limit on the
number of messages that can be buffered. The default/etc/syslog-ng.conf file sets
log_fifo_size to 10000.
• syslog-ng has a time_reopen() option to configure the time to wait before a dead
connection is reestablished. The /etc/syslog-ng.conf file has time_reopen() set to
10 seconds.
• Serviceguard offers various configuration options to improve failover times such as
HEARTBEAT_INTERVAL and NODE_TIMEOUT. Serviceguard Extension for Faster Failover
(SGeFF) is also available to optimize failover times for two-node clusters. Since syslog-ng
itself starts quickly, SGeFF is an ideal candidate for improving failover times and minimizing
message loss.
3.3 Log Consolidation Configuration 53