HP XC System Software Administration Guide Version 2.1

Destinations Contains the devices and files where the m essage
s are sent or sav ed.
Logs
Combines the sources, filters, and destinati
on into specific r ules to
handle the different messages.
The syslog-ng tool provides a basic set of fil
ters that process messages; the following table
indicates where specific message types
are sent.
Message–SeverityLevel Sentto:
info /var/log/messages
critical /var/log/spooler
ranging from warning to emergency
/var/log/nodename
Message–FacilityType
Sent to:
authpriv
(for example, ssh system log failures)
/var/log/secure
mail
/var/log/maillog
uucp
/var/log/spooler
news
/var/log/spooler
cron
/var/log/cron
There is also a filter that processes logging for the cexec command. These logs are placed in
the /var/log/nodename file.
The HP XC System Software uses a tiered st ructur e for logging node events; these tiers are
named local, regional, and global. Figure 6-1 illustrates this structure.
Man
agement hubs are used to aggregate system information for a set of local nodes. Each
man
agement hub runs the fo llowing services:
• Supermon aggregator (supermond)
• Syslog-ng aggregator (syslogng_forward)
The
assignments of the regio nal nodes are made when the HP XC system is in stalled and
con
figured. The head node is the global node. All oth er nodes are local n odes. The glob al
an
d regional nodes are aggregators because they receive aggregated messages from regional
no
des and local node, respectively.
At the local level, each node in the system logs errors and events in its own
/var/log/nodename directory, where nodename identifies the local node. Inter e sting
logs are sent t o the region al level.
A node at the regional level accepts logs from the local nodes and accumulates them in the
/hptc_cluster/adm/logs/nodename directory, where nodename is the name of
the local node. It filters the lo g data, and the important logs are sent to the global level. The
syslog-ng service forwards this log data.
The global node accepts the logs from the regional nodes and accum ulates them in
/hptc_cluster/adm/logs/consolidated.log. This file also rep or ts errors an d
events from the g lobal node.
The shownode command identifies the nodes that supply the syslog_ng service. The
following command returns all the names of the nodes that provide this service:
# shownode servers | grep syslogng_forward
syslogng_forward: n[3-4]
Monitoring the System 6-11