HP Linux Server Management Software User Manual
Page 72
2.
The syslog-ng startup procedure, /etc/init.d/syslog-ng, relies on several
configuration variables. Edit /etc/sysconfig/syslog-ng as follows:
a.
Change the CLOG_CONFIGURED line to:
CLOG_CONFIGURED=1
b.
Add the following lines:
CLOG_CONSOLIDATOR=0
CLOG_CONS_IP=
c.
If using the TCP protocol, add the following lines:
CLOG_TCP=1
CLOG_TCP_PORT=
If using ssh port forwarding, add:
CLOG_SSH=1
CLOG_SSH_PORT=
otherwise, add:
CLOG_SSH=0
otherwise, if using the UDP protocol, add:
CLOG_TCP=0
If consolidating the local syslogs, add:
CLOG_SYSLOG=1
otherwise add:
CLOG_SYSLOG=0
If consolidating this cluster’s package logs, add:
CLOG_PACKAGE=1
otherwise, add:
CLOG_PACKAGE=0
3.
All the files edited thus far need to be distributed clusterwide:
# ccp /etc/syslog-ng.conf.client /etc/
# ccp /etc/sysconfig/syslog-ng /etc/sysconfig/
on Red Hat or
# ccp /etc/syslog-ng/syslog-ng.conf.client /etc/
# ccp /etc/sysconfig/syslog-ng /etc/sysconfig/
on SLES.
Create the following symbolic link on each cluster member:
# ln -sf /etc/syslog-ng.conf.client /etc/syslog-ng.conf
on Red Hat or
# ln -sf /etc/syslog-ng/syslog-ng.conf.client /etc/syslog-ng.conf
on SLES.
4.
When using TCP with ssh port forwarding, record the ssh port number you chose above
in the /etc/services file. For example, add the line:
clog_ssh 1776/tcp # Consolidated logging with ssh port forwarding
Add this line to the /etc/services file of each cluster member.
5.
To consolidate this cluster’s package logs, additional manual steps are needed on the log
consolidation server. Each time a package is created or deleted on this cluster, these steps
need to be done. Refer to
“Consolidating Package Logs on the Log Consolidation Server”
.
72
Consolidated Logging