Distributed Systems Administration Utilities User's Guide

where the <%IP%> is replaced by the server’s IP address or local hostname and the <%PORT%>
is replaced by the selected TCP port number.
For UDP:
destination d_syslog_udp { udp(“local_hostname” port(514)); }
where <%IP%> is replaced by the server’s IP address or local hostname and the <%PORT%>
token is replaced by 514, the standard syslog UDP port.
• Replace the<%FS%> token with the filesystem or directory where the consolidated logs will
be kept. For example,
destination d_syslog { file(“<%FS%>/syslog/syslog.log”); };
becomes:
destination d_syslog { file(“/clog/syslog/syslog.log”); };
Make sure that this directory exists or the appropriate filesystem is mounted. Since
consolidated logs can grow quite large, HP recommends that this filesystem use the largefiles
option and that there is sufficient room for growth.
• When using TCP, record the port number you choose above in the /etc/services file.
For example, add the line:
clog_tcp 1776/tcp # Consolidated logging with syslog-ng
• Create the following symbolic link:
ln -sf /etc/syslog-ng.conf.server /etc/syslog-ng.conf
• The syslog-ng startup procedure, /sbin/init.d/syslog-ng, relies on several
configuration variables. Edit /etc/rc.config.d/syslog-ng as follows:
— Change the CLOG_CONFIGURED line to:
CLOG_CONFIGURED=1
— Add the following lines:
CLOG_CONSOLIDATOR=1
CLOG_FS=directory where the consolidated logs will be stored
If using the TCP protocol, add:
CLOG_TCP=1
CLOG_TCP_PORT=tcp port chosen for log consolidation
otherwise, if using the UDP protocol, add:
CLOG_TCP=0
If consolidating the local syslogs, add:
CLOG_SYSLOG=1
otherwise add:
CLOG_SYSLOG=0
For a standalone consolidator, add the following:
CLOG_SYSTEM_LOG_CONSOLIDATION_DIR=<consolidated log directory/syslog>
CLOG_SERVICEGUARD_PACKAGE_LOG_CONSOLIDATION_DIR=<consolidated log directory/packages>
— Add the following two values that are used by the System and Consolidated Log Viewer:
CLOG_LAYOUTS_DIR=/var/opt/dsau/layouts
CLOG_ADDITIONAL_LOG_DIRS[0]=/var/adm/syslog
• Test the configuration by performing the following steps:
58 Consolidated Logging