HP UX System Adstration manual Log files that reside on this cluster can be consolidated

Page 50

proceeding.

-An IP address and subnet address pair for the package. IPv4

or IPv6 addresses can be used. The IP address should be registered in DNS, if this cluster will consolidate logs from remote clients.

This should be appropriately configured on each cluster member before proceeding with the consolidation server configuration.

Answer yes (y).

In a cluster, the wizard configures syslog-ngto be highly available using a Serviceguard package. For consolidated logging, the package name is clog. The LVM storage configuration and network configuration for the package must be set up before continuing or before running the wizard. For additional details, refer to the section “Creating a Storage Infrastructure with LVM” in the chapter “Building an HA Cluster Configuration,” in the Managing Serviceguard manual.

NOTE: The wizard only supports creating packages based on LVM volume groups. When using CFS or VxVM, manual configuration is required. See the section “Manually Configuring Log Consolidation” (page 56) for details.

The wizard prompts for the following, all of which should have already been configured:

1.LVM volume group name (for example, /dev/vgclog).

2.Logical volume in the volume group (for example, /dev/vgclog/lvol1).

3.The filesystem’s mount point (for example, /clog).

4.The filesystem’s mount options (for example, –o rw,largefiles). The mount options are used verbatim in the Service package control script’s FS_MOUNT_OPT[0] field. Note that the mount options must agree with the filesystem you created on the logical volume. For example, if the filesystem was created with largefiles support, the largefiles mount option should be specified. Since consolidated logs tend to be large, it is recommended to configure VxFS filesystems with the largefiles option.

5.The filesystem type (for example, vxfs).

6.The package IP address. This should also be a registered DNS name so the log forwarding is easy to configure on client systems.

7.The package subnet. (Use the netstat -icommand to determine the proper subnet.)

Next, the wizard prompts for the clients' transport.

You can choose to have the clients forward logs to this consolidation server using either the UDP or the TCP protocol (recommended).

Do you want to use the TCP protocol? (y/n) [y]: y

You need to choose a free port on this cluster for receiving logs. The port chosen should be free on all cluster nodes.

Note: When configuring log consolidation on the clients, this port will need to be specified.

Enter the TCP port to be used for receiving logs []: 1776

Note that selecting TCP does not necessarily preclude the use of UDP forwarded log messages by clients. Whether the log consolidator allows TCP log messages exclusively depends on whether the system is consolidating its own local syslog file. See below for details.

When answering Yes to TCP, you must select a free TCP port. This port must be free on all cluster members. See the section “Configuring a Log Forwarding Client Using clog_wizard” (page 54) using the clog_wizard for details on choosing a TCP port.

Next the wizard prompts for which local logs should be consolidated:

Log files that reside on this cluster can be consolidated.

50 Consolidated Logging

Page 49 Page 51
Image 50
Page 49 Page 51
Contents Distributed Systems Administration Utilities Users Guide Copyright 2009 Hewlett-Packard Development Company, L.P Table of Contents HP-Supported Open Source pdsh Options Index Syslog-ngLog-Forwarding Configuration List of FiguresList of Tables Consolidated Logging CommandsTarget Node Error Messages Typographic Conventions About this DocumentIntended Audience Related InformationProduct Support HP Encourages Your Comments Introduction Consolidated Logging Commands Distributed Systems Administration Utilities CommandsConfiguration Synchronization Command Command Fanout CommandsOpen Source pdsh Commands Utility Setup CommandOpen Source cfengine Commands Open Source ComponentsDsau Manual Page Sections Distributed Systems Administration Utilities Manual PagesOpen Source syslog-ng Command Configuration Synchronization Cfengine OverviewCfengine Daemons and Commands Configuration SynchronizationCfengine Master Server Deployment Models Cfengine OverviewConfiguring cfengine Using the Configuration Synchronization WizardWizard displays the following introductory screen Configuration Data for csyncwizard# /opt/dsau/sbin/csyncwizard Wizard proceeds to configure the system as a master server # /opt/dsau/sbin/csyncwizard Configuration Synchronization Configuring cfengine Would you like to manage clients? N Cluster Configuration Notes for cfengine Serviceguard Automation FeaturesVar/opt/dsau/cfengine/inputs directory Using the Wizard to Configure a Synchronization Client Opt/dsau/bin/csyncdispatcher Memberadded newhostManual Configuration When prompted, enter the name of the client to add# mkdir -p /var/opt/dsau/cfenginemaster/inputs Manually Configuring a Standalone Synchronization ServerStart by creating the directory # /opt/dsau/sbin/cfkey # /var/opt/dsau/cfengine/ppkeys # cp localhost.pub root-10.0.0.5.pub# cfrun -- --inform # /sbin/init.d/cfservd start# cfagent --no-lock --verbose --no-splay # cfrun -v -- --verboseInitial Serviceguard Package Preparation # mkdir -p /csync/dsau/cfenginemaster/masterfilesPolicyhost = csync.abc.xyz.com List Managed Clients in cfrun.hostsEdit the cfservd.conf File # /opt/dsau/sbin/cfkey# ccp * /var/opt/dsau/cfengine/ppkeys # ccp /etc/rc.config.d/cfservd /etc/rc.config.d/cfservd# cp localhost.pub root-192.10.25.12.pub # cexec /sbin/init.d/cfservd startApply the package and start it Test the configuration by performing the following steps# ccp csync csync.conf /etc/cmcluster/csync # cmapplyconf -P csync.conf # cmmodpkg -e csyncConfiguring a Synchronization Managed Client On a managed client, use the commandSecurity Notes Choosing a Synchronization Invocation MethodEncryption Key ExchangeCsync Network Port Usage Encryption Checksum alertsChecksum Alerts Disabling Use of cfengineLogging Options # /sbin/init.d/cfservd stop#cfagent -K Cfengine TroubleshootingSyntax error due to missing or superfluous spaces Unable to connect to a cfengine client or masterCfagent -d, -d1, -d2, or -d3 cfservd Cfrun Syslog Message Format Consolidated LoggingIntroduction to syslog 2describes syslog Facilities MessagesImproved Log Consolidation Log Consolidation OverviewMessage Filtering Syslog Co-existence Etc/cmcluster/package-name/package-name.log Log Consolidation Configuration Syslog-ng Log Consolidator ConfigurationOpt/dsau/sbin/clogwizard Using the Log Consolidation WizardConfiguration Data for clogwizard Answer yes y. The wizard then prompts Where N is the expected number of clientsAnswer yes y or press Enter. The next question is If these choices are correct, continue Next prompt is Log files that reside on this cluster can be consolidated Consolidated package logs would be located here Cluster Configuration Notes for clog Minimizing Message Loss During Failover Configuring a Log Forwarding Client Using clogwizard Or press Enter. The next question isEnter the ssh port to be used for port forwarding Manually Configuring Log Consolidation Manually Configuring a Standalone Log Consolidation ServerFor example, for TCP # /sbin/init.d/syslogd stop # /sbin/init.d/syslogd startReplace the %UDPLOOPBACKLOG% token with If using the TCP protocol, add Create the following symbolic linkChange the Clogconfigured line to Add the following linesLog Consolidation Configuration SYSLOGDOPTS=-D -N KEEPALIVE% tokens with appropriate values UDPLOOPBACKSOURCE% and %UDPLOOPBACKLOG% tokens If consolidating package logs of this cluster, add Creating the clog PackageIf using VxVM, comment out the LVM Volume Group line Then use cmviewcl to make sure it is running Testing and Starting the clog PackageDistribute it cluster-wide Manually Configuring a Standalone Log Forwarding Client Manually Configuring Log Forwarding ClientsUsing VxVM Instead of LVM Ln -sf /etc/syslog-ng.conf.client /etc/syslog-ng.conf # /sbin/init.d/syslog-ng start # cpp /etc/rc.config.d/syslogd /etc/rc.config.d Destination dsyslog%TYPE% %TYPE%%IP%port%PORT% Otherwise, if using the UDP protocol, add If using the TCP protocol, add the following linesIf using ssh port forwarding, add Create the following symbolic link on each cluster memberStart syslog-ngon all cluster members using Forwarding Ascii Log DataFor the destination line For the filter lineConsolidating Package Logs on the Log Consolidation Server For the log lineDisabling a Standalone Log Consolidation System Perform the following steps to disable log consolidationDisabling Log Consolidation #/sbin/init.d/syslogd stop#/sbin/init.d/syslogd start Disabling a Serviceguard Cluster Log Consolidation SystemDisabling a Standalone Log Forwarding Client # /sbin/init.d/syslog-ng stopDisabling a Serviceguard Cluster Log Forwarding Client #/sbin/init.d/syslogd stop #/sbin/init.d/syslogd startSsh Port Forwarding Securing Consolidated LogsLog File Protections # cd /opt/ssh/etc # ccp sshhost* /opt/ssh/etc Using Bastille to Harden the SystemClog Network Port Usage Starting System Management Homepage Using the System and Consolidated Log ViewerViewing System and Consolidated Logs To log in to the System Management Homepage, navigate toViewing System and Consolidated Logs Page Command Fanout Parallel Distributed ShellSystems Pdsh Utility WrappersAll nodes Cwall displays a wall1M broadcast message on multiple hostsSsh Security Setup Security ConfigurationRemote Shell Security Setup # csshsetup -r -f memberslist.txtRsh Command Messages Command Fanout TroubleshootingSsh Command Messages Target Node Error MessagesHP-Supported Open Source pdsh Options Page Index CfanouthostsLVM UDP
Top Page Image Contents