Jump to content United States-English
HP.com Home Products and Services Support and Drivers Solutions How to Buy
» Contact HP
More options
HP.com home
 Distributed Systems Administration Utilities User's Guide > Chapter 3 Consolidated Logging

Disabling Log Consolidation
» 

Technical documentation

Complete book in PDF
» Feedback
Content starts here

 » Table of Contents

 » Index

spacerspacerspacer
spacer
spacer
  		 
 

The clog_wizard enables log consolidation configurations but does not have an unconfigure or deconfigure option. Thus you must disable a system from participating in log consolidation manually, using the following instructions for each system type to:

  • Disable a standalone log consolidation system

  • Disable a Serviceguard cluster log consolidation system

  • Disable a standalone log forwarding client

  • Disable a Serviceguard log forwarding client

Disabling a Standalone Log Consolidation System

Perform the following steps to disable log consolidation:

  1. If the local syslogs were being consolidated, or the UDP protocol was used, edit /etc/rc.config.d/syslogd and change SYSLOGD_OPTS to remove the-N switch. For example, make the following edit:

    SYSLOGD_OPTS=“-D”

  2. If the local syslogs were being consolidated, also edit the system’s /etc/syslog.conf file to remove the following lines:

    mail.debug             @fully qualified hostname *.info;mail.none       @fully qualified hostname

    where fully qualified hostname is the fully qualified hostname of this system.

    NOTE: A <tab> precedes each @ sign.

  3. Stop and restart syslogd using the following commands:

    #/sbin/init.d/syslogd stop

    #/sbin/init.d/syslogd start

  4. Stop syslog-ng:

    # /sbin/init.d/syslog-ng stop

  5. Edit the /etc/rc.config.d/syslog-ng file, as follows:

    1. Change the CLOG_CONFIGURED line to CLOG_CONFIGURED=0.

    2. Remove all other CLOG lines except for the following:

      CLOG_LAYOUTS_DIR=/var/opt/dsau/layouts CLOG_ADDITIONAL_LOG_DIRS[0]=/var/adm/syslog

  6. If the TCP protocol was used, remove the following line from /etc/services:

    clog_tcp port/tcp # Consolidated logging with syslog-ng

Disabling a Serviceguard Cluster Log Consolidation System

Perform the following steps to disable log consolidation in a Serviceguard cluster. Perform these steps on each cluster member:

  1. If local syslogs were being consolidated or the UDP protocol was used, edit /etc/rc.config.d/syslogd and change SYSLOGD_OPTS to remove the -N switch. For example:

    SYSLOG_OPTS="-D"

  2. Stop and restart syslogd with the following commands:

    # /sbin/init.d/syslogd stop

    # /sbin/init.d/syslogd start

  3. If the local syslogs were being consolidated, edit the system’s /etc/syslog.conf file to remove the following lines:

    mail.debug             @fully qualified hostname *.info;mail.none       @fully qualified hostname

    Where fully qualified hostname is the fully qualified hostname of this system. Note that a <tab> precedes each @ sign.

  4. Halt the clog package with the command:

    #/usr/sbin/cmhaltpkg clog

  5. Stop syslog-ng with the following command:

    # /sbin/init.d/syslog-ng stop

    (This stops the syslog-ng daemon and package log consolidation if configured.)

  6. Edit the /etc/rc.config.d/syslog-ng file and change the CLOG_CONFIGURED line to the following:

    CLOG_CONFIGURED=0

    Remove all other CLOG lines except for:

    CLOG_LAYOUTS_DIR=/var/opt/dsau/layouts 
CLOG_ADDITIONAL_LOG_DIRS[0]=/var/adm/syslog

  7. Delete the clog package with the following command:

    # cmdeleteconf -p clog

Disabling a Standalone Log Forwarding Client

Perform the following steps to disable log forwarding on a standalone client:

  1. If syslog messages were being forwarded to the log consolidator, edit /etc/rc.config.d/syslogd and change SYSLOGD_OPTS to remove the -N switch. For example,

    SYSLOGD_OPTS=“-D”

  2. Edit the systems /etc/syslog.conf file to remove the following lines:

    mail.debug             @fully qualified hostname 
*.info;mail.none       @fully qualified hostname

    where fully qualified hostname is the fully qualified hostname of this system.

    NOTE: A <tab> precedes each @ sign.

  3. Stop and restart syslogd with the following commands:

    #/sbin/init.d/syslogd stop

    #/sbin/init.d/syslogd start

  4. Stop syslog-ng with the following command:

    # /sbin/init.d/syslog-ng stop

    This stops the syslog-ng daemon and also ssh port forwarding if configured.

  5. Edit the /etc/rc.config.d/syslog-ng file and change the CLOG_CONFIGURED line to the following:

    CLOG_CONFIGURED=0

    Remove all other CLOG lines except for the following:

    CLOG_LAYOUTS_DIR=/var/opt/dsau/layouts 
CLOG_ADDITIONAL_LOG_DIRS[0]=/var/adm/syslog

  6. If ssh port forwarding had been configured, remove the following line from /etc/services:

    clog_ssh port/tcp # Consolidated logging with ssh port forwarding

Disabling a Serviceguard Cluster Log Forwarding Client

Perform the following steps to disable log forwarding. Complete these steps on each cluster member:

  1. If syslog messages were being forwarded to the log consolidator, edit /etc/rc.config.d/syslogd and change SYSLOGD_OPTS to remove the -N switch. For example, SYSLOGD_OPTS=“-D”.

  2. Edit the system’s /etc/syslog.conf file to remove the following lines:

    mail.debug             @fully qualified hostname *.info;mail.none        @fully qualified hostname

    where fully qualified hostname is the fully qualified hostname of this system.

    NOTE: A <tab> precedes each @ sign.

  3. Stop and restart syslogd with the following commands:

    # /sbin/init.d/syslogd stop

    # /sbin/init.d/syslogd start

  4. Stop syslog-ng:

    # /sbin/init.d/syslog-ng stop

    This stops the syslog-ng daemon, stops ssh port forwarding if configured, and stops package log forwarding if configured.)

  5. Edit the /etc/rc.config.d/syslog-ng file and change the CLOG_CONFIGURED line to CLOG_CONFIGURED=0. Remove all other CLOG lines except for the following:

    CLOG_LAYOUTS_DIR=/var/opt/dsau/layouts CLOG_ADDITIONAL_LOG_DIRS[0]=/var/adm/syslog

  6. If ssh port forwarding had been configured, remove the following line from /etc/services:

    clog_ssh port/tcp # Consolidated logging with ssh port forwarding


Log Consolidation Configuration
  		 


Securing Consolidated Logs  
Printable version
Privacy statement Using this site means you accept its terms Feedback to webmaster
© Hewlett-Packard Development Company, L.P.