added and deleted, the DSAU consolidated logging tools will automatically take the appropriate configuration actions. Specifically:

•When adding a member to the cluster, the new member is automatically configured to participate in log consolidation according to the cluster’s configuration. The following files are automatically configured on the added member:

—/etc/rc.config.d/syslog-ng

—/etc/rc.config.d/syslogd

—/etc/syslog.conf

—/etc/syslog-ng.conf.client, /etc/syslog-ng.conf.server, and the /etc/ syslog-ng.conf symbolic link

—/etc/services

•When deleting a member from a cluster:

—The member is still configured as a log-forwarding client and will continue to forward syslog messages to the cluster if that option had been chosen during the initial run of the clog_wizard. If the system should no longer forward log messages to the cluster, rerun the wizard to configure the system to forward to a different consolidator, or disable log consolidation entirely. Refer to “Disabling Log Consolidation” (page 75) for additional information.

—The package logs on the deleted member are still monitored until a reboot. Since this member is no longer part of the cluster, the package logs will not be active.

•When adding or deleting a package, the following automated actions occur:

—The package is added to or deleted from /etc/syslog-ng.conf.servercluster-wide. There is a reserved section of these files dedicated for use by the DSAU tools. The configuration stanzas added in this section direct syslog-ngto filter package log messages into the appropriate consolidated package logs.

—The clog_tail log monitor adds or deletes the package log file from its list of files to monitor.

3.3.1.5Minimizing Message Loss During Failover

When there is a failure on the adoptive node, it takes a finite amount of time for the clog package to fail over to another cluster member. The longer this failover time, the more likely that messages could be lost from the consolidated log. Use the following guidelines to minimize message loss during failover.

•Configure clients to use the TCP transport instead of the UDP transport. UDP messages will be lost unconditionally when the package is down. The TCP protocol contains retry mechanisms, congestion control, and so on, that help minimize message loss.

•syslog-ng can buffer TCP messages on the client side. The number of messages buffered is controlled by the syslog-ng log_fifo_size setting. This sets an upper limit on the number of messages that can be buffered. The default/etc/syslog-ng.conf file sets log_fifo_size to 10000.

•syslog-nghas a time_reopen() option to configure the time to wait before a dead connection is reestablished. The /etc/syslog-ng.conffile has time_reopen() set to 10 seconds.

•Serviceguard offers various configuration options to improve failover times such as HEARTBEAT_INTERVAL and NODE_TIMEOUT. Serviceguard Extension for Faster Failover (SGeFF) is also available to optimize failover times for two-node clusters. Since syslog-ngitself starts quickly, SGeFF is an ideal candidate for improving failover times and minimizing message loss.

3.3 Log Consolidation Configuration

53