3.The syslog-ng startup procedure, /sbin/init.d/syslog-ng, relies on several configuration variables. Edit /etc/rc.config.d/syslog-ng as follows:

a.Change the CLOG_CONFIGURED line to:

CLOG_CONFIGURED=1

b.Add the following lines:

CLOG_CONSOLIDATOR=0

CLOG_CONS_IP=IP address of the log consolidator

c.If using the TCP protocol add the following lines:

CLOG_TCP=1

CLOG_TCP_PORT=log consolidation server tcp port

If using ssh port forwarding add:

CLOG_SSH=1

CLOG_SSH_PORT=ssh port chosen otherwise , use:

CLOG_SSH=0

otherwise, if using the UDP protocol, use:

CLOG_TCP=0

If consolidating the local syslogs, use:

CLOG_SYSLOG=1 otherwise, use:

CLOG_SYSLOG=0

4.When using TCP with ssh port forwarding, record the ssh port number you chose above in the /etc/services file. For example, add the line:

clog_ssh 1776/tcp

# Consolidated logging with ssh port forwarding

Add this line to the /etc/services file of this system.

5.Test the configuration by performing the following steps:

a.Run/opt/dsau/sbin/syslog-ng with the -s or --syntax-only option to verify the syntax of the /etc/syslog-ng.conf file. This should be a symbolic link to /etc/ syslog-ng.conf.client as described above.

b.Start syslog-ngusing the following command:

# /sbin/init.d/syslog-ng start

c.If consolidating the local syslogs, use “logger test-message” and make sure this message is in the consolidated syslog.log on the log consolidation server. Note that the logger messages are first sent to the local syslog which forwards them to syslog-ng. By default, syslogd suppresses duplicate messages. If you issue multiple logger test messages, make sure each is unique.

3.3.2.3.2 Manually Configuring a Serviceguard Cluster as a Log Forwarding Client

Configuring a Serviceguard cluster as a log forwarding client is similar to configuring a single system. All cluster members must be up and accessible before proceeding. You will first configure syslogd, then syslog-ng.

Create the configuration files described below on every cluster member. The simplest approach is to completely configure one member and then copy each configuration file cluster-wide. The cexec and ccp tools can simplify replicating changes cluster-wide.

68 Consolidated Logging