HP Linux Server Management Software - Manual (Page 56)

DSAU maintains two configuration files that control whether the instance of syslog-ng on a
particular cluster member operates as a consolidation server or a log forwarding client:
/etc/syslog-ng.conf.server
and /etc/syslog-ng.conf.client on Red Hat and
/etc/syslog-ng/syslog-ng.conf.server and
/etc/syslog-ng/syslog-ng.conf.client on SLES. The symbolic link /etc/
syslog-ng.conf or /etc/syslog-ng/syslog-ng.conf points to one of the configuration
files. When the cluster is booted, all the members start as log forwarding clients with syslog-ng
running on each member. The /etc/init.d/syslog-ng startup script sets the symbolic link
/etc/syslog-ng.conf
on Red Hat or /etc/syslog-ng/syslog-ng.conf on SLES to
point to /etc/syslog-ng.conf.client on Red Hat or
/etc/syslog-ng/syslog-ng.conf.client
on SLES.
When the clog package starts, the adoptive node restarts that instance of syslog-ng as a log
consolidation server instance. The package script resets the /etc/syslog-ng.conf on Red
Hat or /etc/syslog-ng/syslog-ng.conf on SLES symbolic link to point to
/etc/syslog-ng.conf.server
on Red Hat or /etc/syslog-ng/syslog-ng.conf.server
on SLES. If the clog package is halted, the symlink is changed to point to
/etc/syslog-ng.conf.client
on Red Hat or /etc/syslog-ng/syslog-ng.conf.client
on SLES and the syslog-ng instance on that member restarted. Note that when a cluster is a
log consolidation server, and the package is down, no log consolidation occurs and forwarded
log messages are lost.
Cluster members can forward log messages to the consolidator using either UDP or TCP. Within
a Serviceguard cluster, ssh port forwarding is not used. ssh port forwarding can be used to
secure the log traffic forwarded by remote clients outside the cluster. For additional information,
refer to
“ssh Port Forwarding” (page 78) .
3.3.1.4 Serviceguard Automation Features
The Distributed Systems Administration Utilities require Serviceguard 11.17 or later. With
Serviceguard 11.17 or later, when members are added to or deleted from cluster or packages are
added and deleted, the DSAU consolidated logging tools will automatically take the appropriate
configuration actions. Specifically:
• When adding a member to the cluster, the new member is automatically configured to
participate in log consolidation according to the cluster’s configuration. The following files
are automatically configured on the added member:
— /etc/sysconfig/syslog-ng
— /etc/syslog-ng.conf.client, /etc/syslog-ng.conf.server, and the /etc/
syslog-ng.conf symbolic link on Red Hat or /etc/syslog-ng/
syslog-ng.conf.client , /etc/syslog-ng/syslog-ng.conf.server, and the
/etc/syslog-ng/syslog-ng.conf symbolic link on SLES.
— /etc/services
• When deleting a member from a cluster:
— The member is still configured as a log-forwarding client and will continue to forward
syslog messages to the cluster if that option had been chosen during the initial run of
the clog_wizard. If the system should no longer forward log messages to the cluster,
rerun the wizard to configure the system to forward to a different consolidator, or
disable log consolidation entirely. Refer to
“Disabling Log Consolidation” (page 77)
for additional information.
— The package logs on the deleted member are still monitored until a reboot. Since this
member is no longer part of the cluster, the package logs will not be active.
• When adding or deleting a package, the following automated actions occur:
— The package is added to or deleted from /etc/syslog-ng.conf.server on Red
Hat or /etc/syslog-ng/syslog-ng.conf.server on SLES clusterwide. There is
a reserved section of these files dedicated for use by the DSAU tools. The configuration
56 Consolidated Logging