1.For each package that will be forwarded from a cluster client, add the following destination, filter and log lines to the syslog-ng.conf.serverfile, after the

HP_AUTOMATED_LOG_FILE_CONSOLIDATION section.

destination d_<clu1>_<pkg1> { file(“<fs>/packages/<clu1>_<pkg1>.log”); }; filter f_<clu1>_<pkg1> { program(<clu1>_<pkg1>.log); };

log { source(s_syslog_<type>);

filter(f_<clu1>_<pkg1>);destination(d_<clu1>_<pkg1>); flags(final);};

where <pkg1> is the package name, <clu1> is the package’s relocatable IP address that is forwarding this package log, <type> is either _tcp or _udp, depending on the log transport selected, and <fs> is the filesystem on the log consolidator where the consolidated logs will be stored.

2.If the log consolidator is a Serviceguard cluster, make sure to copy the edited /etc/ syslog-ng.conf.serverfile cluster-wide as follows:

# ccp /etc/syslog-ng.conf.server /etc/

3.sighup syslog-ngon the log consolidator, so that it re-reads its configuration file. (sighup is a UNIX method for restarting a process.) On a Serviceguard log consolidator, sighup syslog-ngonly on the adoptive node of the clog package.

4.For each package that is deleted from a cluster client that is forwarding its package logs, delete the corresponding destination, filter and log lines from the /etc/ syslog-ng.conf.serverfile of the log consolidator. syslog-ngon the log consolidator will need to be sighup’d so that it re-reads this configuration file. On a Serviceguard log consolidator, the updated /etc/syslog-ng.conf.serverfile will need to be distributed cluster-wide. However, the sighup of syslog-ngonly needs to be done on the adoptive node of the clog package.

3.4Disabling Log Consolidation

The clog_wizard enables log consolidation configurations but does not have an unconfigure or deconfigure option. Thus you must disable a system from participating in log consolidation manually, using the following instructions for each system type to:

•Disable a standalone log consolidation system

•Disable a Serviceguard cluster log consolidation system

•Disable a standalone log forwarding client

•Disable a Serviceguard log forwarding client

3.4.1Disabling a Standalone Log Consolidation System

Perform the following steps to disable log consolidation:

1.If the local syslogs were being consolidated, or the UDP protocol was used, edit /etc/ rc.config.d/syslogd and change SYSLOGD_OPTS to remove the-N switch. For example, make the following edit:

SYSLOGD_OPTS=“-D”

2.If the local syslogs were being consolidated, also edit the system’s /etc/syslog.conf file to remove the following lines:

mail.debug

@fully

qualified

hostname

*.info;mail.none

@fully

qualified

hostname

where fully qualified hostname is the fully qualified hostname of this system.

NOTE: A <tab> precedes each @ sign.

3.Stop and restart syslogd using the following commands:

#/sbin/init.d/syslogd stop

3.4 Disabling Log Consolidation 75