MonitorWare Knowledge Base

Hello again

Let's say i have a log cluster, with two nodes (say node1.example.com and node2.example.com) and a shared IP address.

In that situation i would probably want each node to log to the shared IP in favour of to itself, given i want everything in the shared location, and am too tight to invest in GFS.

I figured i'd request all log messages from "localhost" to go to logCluster.example.com which would mean that the standby node does not generate any local files in the SAN (/san/local).

Alas, the on the standby node is perceived as coming from node2, so the DynFile stuff kicks in instead and it logs to /san/local/node2.messages.log instead

I can't opt for filtering to scripture based on "node1" or "node2" since the active node still needs to log to itself (from a logical standpoint).

I also can not opt for a startup script on the node becoming active to move a active.rsyslog.conf to rsyslog.conf because AFAIK the passive node does not perform an equivalent action. So short of granting ssh access from node to node to fling files around, is there something i could put in the files on both nodes which will make the distinction?

Alternatively, how do i make the system log as localhost?

Code: Select all

$ModLoad immark.so # provides --MARK-- message capability
$ModLoad imudp.so # provides UDP syslog reception
$ModLoad imtcp.so # provides TCP syslog reception and GSS-API (if compiled to support it)
$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so # provides kernel logging support (previously done by rklogd)

##
##
##
:HOSTNAME, isequal, "localhost"            @@logCluster.example.com
##
##
##
$template DynFile.messages,"/san/local/%HOSTNAME%.messages.log
$template DynFile.iptables,"/san/local/%HOSTNAME%.iptables.log
$template DynFile.secure,"/san/local/%HOSTNAME%.secure.log
$template DynFile.mail,"/san/local/%HOSTNAME%.mail.log
$template DynFile.cron,"/san/local/%HOSTNAME%.cron.log
$template DynFile.emerg,"/san/local/%HOSTNAME%.emerg.log
$template DynFile.spooler,"/san/local/%HOSTNAME%.spooler.log
$template DynFile.boot,"/san/local/%HOSTNAME%.boot.log
$template DynFile.newsCrit,"/san/local/%HOSTNAME%.news.crit
$template DynFile.newsErr,"/san/local/%HOSTNAME%.news.err
$template DynFile.newsNotice,"/san/local/%HOSTNAME%.news.notice

kern.*;*.info;mail.none;news.none;authpriv.none;cron.none       ?DynFile.messages
:msg, contains, "IPTABLES"                              ?DynFile.iptables
authpriv.*                                              ?DynFile.secure
mail.*                                                  ?DynFile.mail
cron.*                                                  ?DynFile.cron
*.emerg                                                 ?DynFile.emerg
uucp,news.crit                                          ?DynFile.spooler
local7.*                                                ?DynFile.boot
news.=crit                                              ?DynFile.newsCrit
news.=err                                               ?DynFile.newsErr
news.notice                                             ?DynFile.newsNotice



• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

mmmhhhh. what you really need is the expression engine that is not yet there (to be developed after store-and-forward mode), I'd say not earlier than mid-march.

But you can create a message template which sets the hostname to a fixed value (in the @@ action). I am very busy with store-and-forward at the moment (which I would absolutely like to finish by the end of the month...). But mabe someone else comes in - or you play a bit with the templates. Just do not use HOSTNAME in it but a fixed value.

Rainer

fair enough, i can prolly cope