Distributed Systems Administration Utilities User's Guide, Linux, March 2009

Restart syslog-ng on all cluster nodes.
3. For each text log that is deleted from a client that is forwarding its text logs, delete the
corresponding destination, filter and log lines from the /etc/syslog-ng.conf.server
file on Red Hat or /etc/syslog-ng/syslog-ng.conf.server file SLES of the log
consolidator. syslog-ng on the log consolidator must be sighup’d so that it rereads this
configuration file.
On a Serviceguard log consolidator, the updated /etc/syslog-ng.conf.server file on
Red Hat or /etc/syslog-ng/syslog-ng.conf.server file on SLES must be distributed
clusterwide. However, the sighup of syslog-ng needs to be done only on the adoptive
node of the clog package.
3.3.2.4 Consolidating Package Logs on the Log Consolidation Server
When remote Serviceguard clusters forward package log data to a log consolidation server, the
default is to place all forwarded log messages in the consolidated syslog.log file on the
consolidation server. It can be much more convenient to place these messages in cluster-specific
consolidated package log files instead of in the consolidated syslog.log file. This can be
achieved using syslog-ng’s filtering rules as follows:
1. For each package that will be forwarded from a cluster client, add the following destination,
filter and log lines to the syslog-ng.conf.server file, after the
HP_AUTOMATED_LOG_FILE_CONSOLIDATION section.
destination d_<clu1>_<pkg1> { file(“<fs>/packages/<clu1>_<pkg1>.log”); };
filter f_<clu1>_<pkg1> { program(<clu1>_<pkg1>.log); };
log { source(s_syslog_<type>);
filter(f_<clu1>_<pkg1>);destination(d_<clu1>_<pkg1>); flags(final);};
where <pkg1> is the package name, <clu1> is the package’s relocatable IP address that is
forwarding this package log, <type> is either _tcp or _udp, depending on the log transport
selected, and <fs> is the filesystem on the log consolidator where the consolidated logs will
be stored.
2. If the log consolidator is a Serviceguard cluster, make sure to copy the edited /etc/
syslog-ng.conf.server file on Red Hat or /etc/syslog-ng/
syslog-ng.conf.server on SLES clusterwide as follows:
# ccp /etc/syslog-ng.conf.server /etc/
on Red Hat or
# ccp /etc/syslog-ng/syslog-ng.conf.server /etc/
on SLES.
3. sighup syslog-ng on the log consolidator, so that it re-reads its configuration file. (sighup
is a UNIX method for restarting a process.) On a Serviceguard log consolidator, sighup
syslog-ng only on the adoptive node of the clog package.
4. For each package that is deleted from a cluster client that is forwarding its package logs,
delete the corresponding destination, filter and log lines from the /etc/
syslog-ng.conf.server file on Red Hat or /etc/syslog-ng/
syslog-ng.conf.server file on SLES of the log consolidator. syslog-ng on the log
consolidator will need to be sighup’d so that it re-reads this configuration file. On a
Serviceguard log consolidator, the updated /etc/syslog-ng.conf.server file on Red
Hat or /etc/syslog-ng/syslog-ng.conf.server file on SLES will need to be
distributed clusterwide. However, the sighup of syslog-ng only needs to be done on the
adoptive node of the clog package.
76 Consolidated Logging