HP UX System Adstration manual For the destination line, For the filter line

If the text file is already formatted using the syslog-compatible format shown above, then add the corresponding CLOG_TEXT_FORMAT[n]entry with a value of “syslog”.

For example,

CLOG_TEXT_LOG[2]=/var/adm/app/logs/app.log

CLOG_TEXT_FORMAT[2]="syslog"

If no CLOG_TEXT_FORMAT[]entry is made for a corresponding

CLOG_TEXT_LOG[]entry, the default is “custom”.

For an example of a file in syslogformat, see the actual system log file /var/adm/

syslog/syslog.log.

3.After completing the required edits, there are two ways to initiate forwarding for the new log files:

•Restarting syslog-ng(recommended if not in a production environment)

•Manual restart, that does not disrupt syslog-ng

The procedures are the following:

•Restart syslog-ng. For example, issue the following command:

/sbin/init.d/syslog-ng restart

This will disrupt syslog-ngand may cause loss of messages that are being forwarded or consolidated. If your system is not in a production environment, and losing some messages is acceptable, this method is preferable to using the more difficult manual restart.

•Start the clog_tail process manually for the text log file.

If the text log file is in syslog format, use the following command:

/opt/dsau/bin/clog_tail -q -n 0 -p log_file_path

If the text log file is in a custom format, use the following command:

/opt/dsau/bin/clog_tail -q -n 0 -p -a log_file_path where log_file_path is the complete path to the ASCII log file.

For example, for a log called myapp.log in custom format, the following command starts clog_tail:

# /opt/dsau/bin/clog_tail -q -n 0 -p -a /var/opt/myapp/myapp.log

If the system is a Serviceguard cluster, copy the edited /etc/rc.config.d/ syslog-ngfile cluster-wide with the following command:

# ccp /etc/syslog-ng.conf.server /etc/

Either restart syslog-ngor start the clog_tail of the text-logon all cluster nodes.

3.3.2.3.3.2 Consolidating Text Logs on the Log Consolidation Server

To consolidate the text logs forwarded from clients to a Log Consolidation Server, complete the following tasks on the Log Consolidation Server:

1.For each text log that will be forwarded from a client, add the following destination, filter and log lines to the file syslog-ng.conf.server, after the section called

HP_AUTOMATED_LOG_FILE_CONSOLIDATION:

For the destination line:

destination d_node1_text1{ file(“fs/textdir/node1_text1.log”); };

For the filter line:

filter f_node1_text1{ program(node1_text1.log); };

3.3 Log Consolidation Configuration 73