
Figure 3-2 syslog-ng Log Consolidator Configuration
1
3
2
syslog-ng
fifo
syslog-ng
syslogd
cmcld
TCP/IP
or UDP
Log
reader
+/var/log/
messages
mail log
A B
C
Consolidated Logs:
+ /clog/syslog
-syslog.log
-mail.log
-syslog-ng.log
+/clog/packages
-clog.log
-csync.log
-xclock.log
NOTE: Actual path for cmcluster may be different
+ /usr/local/cmcluster/conf/<package>/
-clog.log
-csync.log
-xclock.log
1. The syslog-ng server reads the incoming log data from the UDP or TCP connected clients.
Note: gray arrows indicate a read operation; black arrows, a write.
2. The gray area is identical to the client configuration in Figure 3-1: “syslog-ng Log-Forwarding
Configuration”. In terms of the local system, syslog-ng acts as client and is processing
locally forwarded clog_tail messages.
3. The syslog-ng server processes all messages and filters them into the appropriate
consolidated log files. In this specific example, the administrator has created a filesystem
named “/clog” to house the consolidated logs. /clog/syslog/ would contain the
consolidated syslog-related file. /clog/packages would contain consolidated package
logs for a Serviceguard cluster.
3.3 Log Consolidation Configuration
The following sections describe how to configure log consolidation servers and log forwarding
clients. Configuring a consolidation server is a multi-step process. The clog_wizard tool vastly
simplifies the configuration process. If you choose not to use the wizard, the manual configuration
steps are also described below.
3.3 Log Consolidation Configuration 49
Commenti su questo manuale