Distributed Systems Administration Utilities User's Guide

1. For each package that will be forwarded from a cluster client, add the following destination,
filter and log lines to the syslog-ng.conf.server file, after the
HP_AUTOMATED_LOG_FILE_CONSOLIDATION section.
destination d_<clu1>_<pkg1> { file(“<fs>/packages/<clu1>_<pkg1>.log”); };
filter f_<clu1>_<pkg1> { program(<clu1>_<pkg1>.log); };
log { source(s_syslog_<type>);
filter(f_<clu1>_<pkg1>);destination(d_<clu1>_<pkg1>); flags(final);};
where <pkg1> is the package name, <clu1> is the package’s relocatable IP address that is
forwarding this package log, <type> is either _tcp or _udp, depending on the log transport
selected, and <fs> is the filesystem on the log consolidator where the consolidated logs will
be stored.
2. If the log consolidator is a Serviceguard cluster, make sure to copy the edited /etc/
syslog-ng.conf.server file cluster-wide as follows:
# ccp /etc/syslog-ng.conf.server /etc/
3. sighup syslog-ng on the log consolidator, so that it re-reads its configuration file. (sighup
is a UNIX method for restarting a process.) On a Serviceguard log consolidator, sighup
syslog-ng only on the adoptive node of the clog package.
4. For each package that is deleted from a cluster client that is forwarding its package logs,
delete the corresponding destination, filter and log lines from the /etc/
syslog-ng.conf.server file of the log consolidator. syslog-ng on the log consolidator
will need to be sighup’d so that it re-reads this configuration file. On a Serviceguard log
consolidator, the updated /etc/syslog-ng.conf.server file will need to be distributed
cluster-wide. However, the sighup of syslog-ng only needs to be done on the adoptive
node of the clog package.
3.4 Disabling Log Consolidation
The clog_wizard enables log consolidation configurations but does not have an unconfigure
or deconfigure option. Thus you must disable a system from participating in log consolidation
manually, using the following instructions for each system type to:
• Disable a standalone log consolidation system
• Disable a Serviceguard cluster log consolidation system
• Disable a standalone log forwarding client
• Disable a Serviceguard log forwarding client
3.4.1 Disabling a Standalone Log Consolidation System
Perform the following steps to disable log consolidation:
1. If the local syslogs were being consolidated, or the UDP protocol was used, edit /etc/
rc.config.d/syslogd and change SYSLOGD_OPTS to remove the-N switch. For example,
make the following edit:
SYSLOGD_OPTS=“-D”
2. If the local syslogs were being consolidated, also edit the system’s /etc/syslog.conf file
to remove the following lines:
mail.debug @fully qualified hostname
*.info;mail.none @fully qualified hostname
where fully qualified hostname is the fully qualified hostname of this system.
NOTE: A <tab> precedes each @ sign.
3. Stop and restart syslogd using the following commands:
#/sbin/init.d/syslogd stop
3.4 Disabling Log Consolidation 75