Distributed Systems Administration Utilities User's Guide, Linux, March 2009

2. The syslog-ng startup procedure, /etc/init.d/syslog-ng, relies on several
configuration variables. Edit /etc/sysconfig/syslog-ng as follows:
a. Change the CLOG_CONFIGURED line to:
CLOG_CONFIGURED=1
b. Add the following lines:
CLOG_CONSOLIDATOR=0
CLOG_CONS_IP=<IP address of the log consolidator>
c. If using the TCP protocol, add the following lines:
CLOG_TCP=1
CLOG_TCP_PORT=<log consolidation server tcp port>
If using ssh port forwarding, add:
CLOG_SSH=1
CLOG_SSH_PORT=<ssh port chosen>
otherwise, add:
CLOG_SSH=0
otherwise, if using the UDP protocol, add:
CLOG_TCP=0
If consolidating the local syslogs, add:
CLOG_SYSLOG=1
otherwise add:
CLOG_SYSLOG=0
If consolidating this cluster’s package logs, add:
CLOG_PACKAGE=1
otherwise, add:
CLOG_PACKAGE=0
3. All the files edited thus far need to be distributed clusterwide:
# ccp /etc/syslog-ng.conf.client /etc/
# ccp /etc/sysconfig/syslog-ng /etc/sysconfig/
on Red Hat or
# ccp /etc/syslog-ng/syslog-ng.conf.client /etc/
# ccp /etc/sysconfig/syslog-ng /etc/sysconfig/
on SLES.
Create the following symbolic link on each cluster member:
# ln -sf /etc/syslog-ng.conf.client /etc/syslog-ng.conf
on Red Hat or
# ln -sf /etc/syslog-ng/syslog-ng.conf.client /etc/syslog-ng.conf
on SLES.
4. When using TCP with ssh port forwarding, record the ssh port number you chose above
in the /etc/services file. For example, add the line:
clog_ssh 1776/tcp # Consolidated logging with ssh port forwarding
Add this line to the /etc/services file of each cluster member.
5. To consolidate this cluster’s package logs, additional manual steps are needed on the log
consolidation server. Each time a package is created or deleted on this cluster, these steps
need to be done. Refer to “Consolidating Package Logs on the Log Consolidation Server”
(page 76).
72 Consolidated Logging