Distributed Systems Administration Utilities User's Guide

5. Validate that log forwarding is working properly. If consolidating the cluster’s local syslogs,
use “logger test-message” and make sure this message is in the consolidated
syslog.log. If you are not consolidating local logs, use the logger command from a log
forwarding client.
Note that logger messages are first sent to the local syslogd, which forwards them to
syslog-ng. By default, syslogd suppresses duplicate messages. If you issue multiple
logger test messages, make sure each is unique. The logger message should appear in
the consolidated syslog.log located in the directory specified in the /etc/
syslog-ng.conf.server file. For the examples above, that directory would be /clog/
syslog/syslog.log.
If consolidating package logs for this cluster, any package actions that generate package log
information, such as a package failover, should cause a consolidated package log to appear
in /clog/packages.
3.3.2.2.3 Using VxVM Instead of LVM
The default clog package script template assumes that you are using LVM based storage. To use
VxVM storage instead, you must edit the clog package script under /usr/local/cmcluster/
conf/clog/clog. Comment out the LVM Volume Group line “VG[0]=“xxx””, uncomment
the line “VXVM_DG[0]=”, and enter the VxVM Disk Group.
3.3.2.3 Manually Configuring Log Forwarding Clients
You can configure either a standalone system or a Serviceguard cluster as log forwarding clients.
You can also manually configure Serviceguard package logs as if they were syslog data. For
each case, you set up both syslogd and syslog-ng.
3.3.2.3.1 Manually Configuring a Standalone Log Forwarding Client
1. Start by configuring the standard syslogd to co-exist with a syslog-ng forwarder.
a. By default, syslogd listens for incoming log messages on UDP port 514. If you want
to forward this system's syslogs, syslog-ng must listen on UDP port 514. Edit /etc/
rc.config.d/syslogd and change SYSLOGD_OPTS to add the-N switch which
prevents syslogd from listening on port 514. For example:
SYSLOGD_OPTS=“-D -N”
b. Edit the system’s /etc/syslog.conf file to forward log messages to port 514 on the
local host where they will be read by syslog-ng. Using the HP-UX default /etc/
syslog.conf as the example, add the following lines:
mail.debug @fully qualified hostname
*.info;mail.none @fully qualified hostname
where fully qualified hostname is the fully qualified hostname of this system.
The name must be fully qualified or syslogd will not forward the messages properly.
If you have customized syslog.conf, make sure to add the forwarding lines for your
customizations as well.
c. Stop and restart syslogd for these changes to take effect:
# /sbin/init.d/syslogd stop
# /sbin/init.d/syslogd start
2. To configure syslog-ng, start with the same syslog-ng.conf templates used by the
clog_wizard.
Copy /opt/dsau/share/clog/templates/syslog-ng.conf.client.template
to /etc/syslog-ng.conf.client. This file has tokens named <%token-name%> that
are replaced by the wizard based on the administrator’s answers to the wizard’s questions.
Manually replace the tokens in /etc/syslog-ng.conf.client as follows:
66 Consolidated Logging