HP XC System Software Administration Guide Version 3.2

date and time stamp |n15 |6289408 |1134780 |5154628 |1164160
date and time stamp |n16 |0 |0 |0 |0
7.6 Logging Node Events
This section describes how the HP XC system uses the syslog and syslogng_forward services
to log node events and how these events are arranged according to the syslog-ng.conf rules
file.
7.6.1 Understanding the Event Logging Structure
The HP XC System Software uses aggregator nodes to log events from clients. Aggregator node
assignments are made when the HP XC System Software is installed and configured. Each node
in the HP XC system is assigned to an aggregator node. One of the aggregator nodes is designated
the master aggregator node. Figure 7-2 illustrates this structure.
Figure 7-2 Aggregator and Client Nodes Structure
Each node runs the syslogd daemon and passes events of priority warning or higher to its
corresponding aggregator node; aggregator nodes also run the syslogd daemon and pass their
own events to the master aggregator node.
Each aggregator node runs the syslogng_forward service, and writes the events it receives
from its clients to the /hptc_cluster/adm/logs/aggregator_nodename.log file, where
nodename is the node name of the aggregator. The aggregator nodes forward their clients' events
to the master aggregator node, which produces a consolidated log file,
/hptc_cluster/adm/logs/consolidated.log.
The assignment of regional and global nodes is made during the execution of the gconfig utility
during installation. You can determine which nodes are the regional nodes with the shownode
command:
# shownode config syslogng_forward
The shownode command identifies the nodes that supply the syslogng_forward service. The
following command returns all the names of the nodes that provide this service:
# shownode servers syslogng_forward
syslogng_forward: n[3-4]
7.6.2 The syslog-ng.conf Rules File
The syslog-ng.conf rules file defines the order of importance by which the log files are
arranged.
The /opt/hptc/syslog-ng/etc/syslog-ng.conf/syslog-ng.conf file defines for the
syslogng_forward service a series of rules on how to handle messages from its clients. The
syslog-ng.conf file contains five types of rules:
Options Defines generic information like reconnection timeouts, FIFO size limits, and
so on.
Sources Defines the different sources from which the messages are obtained.
92 Monitoring the System