For the log line:
log { source(s_syslog_type); filter (f_node1_text1);destination(d_node1_text1); flags(final);};
where text1 is the text logfile name, node1 is the relocatable IP address (for a Serviceguard cluster) or hostname (for a non-Serviceguard cluster) that is forwarding this text log, fs is the filesystem on the log consolidator where the consolidated logs will be stored, type is the “s_source” definition, either _tcp or _udp, depending on the log transport selected, and textdir is the name of the directory where you plan to store all text logs.
2.If the log consolidator is a Serviceguard cluster, make sure to copy the edited /etc/ syslog-ng.conf.serverfile cluster-wide with the following command:
# ccp /etc/syslog-ng.conf.server /etc/
3.sighup syslog-ngon the log consolidator so that it rereads its configuration file. (sighup is a UNIX method for restarting a process.) On a Serviceguard log consolidator, sighup syslog-ngonly on the adoptive node of the clog package.
3.3.2.3.3.3 Stopping Consolidation of Text Logs
To stop consolidation of text logs, complete the following tasks for each system where you plan to stop log consolidation:
1.Edit the system’s /etc/rc.config.d/syslog-ngfile. For each ASCII log file you plan to stop consolidating, do the following:
•Remove the CLOG_TEXT_LOG[] and the corresponding CLOG_TEXT_FORMAT[] entry for that text log, if present.
For example, to stop consolidation of the text log myapp.log, remove the following entries from the /etc/rc.config.d/syslog-ngfile:
CLOG_TEXT_LOG[4]=/var/opt/myapp.log CLOG_TEXT_FORMAT[4]="syslog"
2.After making the required edits, restart syslog-ngusing the command:
/sbin/init.d.syslog-ng restart so that the changes to the /etc/rc/config.d/ syslog-ng file take effect.
If the system is a Serviceguard cluster, copy the edited /etc/rc.config.d/syslog-ngfile cluster-wide with the following command:
# ccp /etc/syslog-ng.conf.server /etc/
Restart syslog-ngon all cluster nodes.
3.For each text log that is deleted from a client that is forwarding its text logs, delete the corresponding destination, filter and log lines from the /etc/syslog-ng.conf.serverfile of the log consolidator. syslog-ngon the log consolidator must be sighup’d so that it rereads this configuration file.
On a Serviceguard log consolidator, the updated /etc/syslog-ng.conf.serverfile must be distributed cluster-wide. However, the sighup of syslog-ngneeds to be done only on the adoptive node of the clog package.
3.3.2.4Consolidating Package Logs on the Log Consolidation ServerWhen remote Serviceguard clusters forward package log data to a log consolidation server, the default is to place all forwarded log messages in the consolidated syslog.log file on the consolidation server. It can be much more convenient to place these messages in cluster-specific consolidated package log files instead of in the consolidated syslog.log file. This can be achieved using syslog-ng’s filtering rules as follows: