Understanding the Event Logging Structure |
 |
The HP XC System Software uses aggregator nodes to log events from clients. Aggregator node assignments are made when the HP XC System Software is installed and configured. Each node in the HP XC system is assigned to an aggregator node. One of the aggregator nodes is designated the master aggregator node. Figure 6-7 illustrates this structure.
Each node runs the syslogd daemon and passes events of priority warning or higher to its corresponding aggregator node; aggregator nodes also run the syslogd daemon and pass their own events to the master aggregator node.
Each aggregator node runs the syslogng_forward service, and writes the events it receives from its clients to the /hptc_cluster/adm/logs/aggregator_nodename.log file, where nodename is the node name of the aggregator. The aggregator nodes forward their clients' events to the master aggregator node, which produces a consolidated log file, /hptc_cluster/adm/logs/consolidated.log.
The assignment of regional and global nodes is made during the execution of the gconfig utility during installation. You can determine which nodes are the regional nodes with the shownode command:
# shownode config syslogng_forward |
The shownode command identifies the nodes that supply the syslogng_forward service. The following command returns all the names of the nodes that provide this service:
# shownode servers syslogng_forward
syslogng_forward: n[3-4] |
The syslog-ng.conf Rules File |
|
The syslog-ng.conf rules file defines the order of importance by which the log files are arranged.
The /opt/hptc/syslog-ng/etc/syslog-ng.conf/syslog-ng.conf file defines for the syslogng_forward service a series of rules on how to handle messages from its clients. The syslog-ng.conf file contains five types of rules:
- Options
Defines generic information like reconnection timeouts, FIFO size limits, and so on.
- Sources
Defines the different sources from which the messages are obtained.
- Filters
Define the rules to segregate messages. For example, messages can be separated by host, severity, facility, and so on.
- Destinations
Contains the devices and files where the messages are sent or saved.
- Logs
Combines the sources, filters, and destination into specific rules to handle the different messages.
You can use a text editor, such as emacs or vi, to read the log files, and you can use a variety of text manipulation commands to find, sort, and format these log files.
Printable version
