Distributed Systems Administration Utilities User's Guide, Linux, March 2009

1. For each text log that will be forwarded from a client, add the following destination, filter
and log lines to the file syslog-ng.conf.server, after the section called
HP_AUTOMATED_LOG_FILE_CONSOLIDATION:
For the destination line:
destination d_node1_text1{ file(“fs/textdir/node1_text1.log”); };
For the filter line:
filter f_node1_text1{ program(node1_text1.log); };
For the log line:
log { source(s_syslog_type); filter (f_node1_text1);destination(d_node1_text1); flags(final);};
where text1 is the text logfile name, node1 is the relocatable IP address (for a Serviceguard
cluster) or hostname (for a non-Serviceguard cluster) that is forwarding this text log, fs is the
filesystem on the log consolidator where the consolidated logs will be stored, type is the
“s_source” definition, either _tcp or _udp, depending on the log transport selected, and
textdir is the name of the directory where you plan to store all text logs.
2. If the log consolidator is a Serviceguard cluster, make sure to copy the edited /etc/
syslog-ng.conf.server file on Red Hat or /etc/syslog-ng/
syslog-ng.conf.server file on SLES clusterwide with the following command:
# ccp /etc/syslog-ng.conf.server /etc/
on Red Hat or
# ccp /etc/syslog-ng/syslog-ng.conf.server /etc/
on SLES.
3. sighup syslog-ng on the log consolidator so that it rereads its configuration file. (sighup
is a UNIX method for restarting a process.) On a Serviceguard log consolidator, sighup
syslog-ng only on the adoptive node of the clog package.
3.3.2.3.3.3 Stopping Consolidation of Text Logs
To stop consolidation of text logs, complete the following tasks for each system where you plan
to stop log consolidation:
1. Edit the system’s /etc/rc.config.d/syslog-ng file. For each ASCII log file you plan
to stop consolidating, do the following:
• Remove the CLOG_TEXT_LOG[] and the corresponding CLOG_TEXT_FORMAT[]
entry for that text log, if present.
For example, to stop consolidation of the text log myapp.log, remove the following
entries from the /etc/rc.config.d/syslog-ng file:
CLOG_TEXT_LOG[4]=/var/opt/myapp.log
CLOG_TEXT_FORMAT[4]="syslog"
2. After making the required edits, restart syslog-ng using the command:
# etc/init.d.syslog-ng restart so that the changes to the etc/init.d.syslog-ng
restart file take effect.
If the system is a Serviceguard cluster, copy the edited /etc/rc.config.d/syslog-ng
file clusterwide with the following command:
# ccp /etc/syslog-ng.conf.server /etc/
on Red Hat or
# ccp /etc/syslog-ng/syslog-ng.conf.server /etc/
on SLES.
3.3 Log Consolidation Configuration 75