This site best when viewed with a modern standards-compliant browser. We recommend Firefox Get Firefox!.

Linux-HA project logo
Providing Open Source High-Availability Software for Linux and other OSes since 1999.

USA Flag UK Flag

Japanese Flag


About Us

Contact Us

Legal Info

How To Contribute

Security Issues

This web page is no longer maintained. Information presented here exists only to avoid breaking historical links.
The Project stays maintained, and lives on: see the Linux-HA Reference Documentation.
To get rid of this notice, you may want to browse the old wiki instead.

1 February 2010 Hearbeat 3.0.2 released see the Release Notes

18 January 2009 Pacemaker 1.0.7 released see the Release Notes

16 November 2009 LINBIT new Heartbeat Steward see the Announcement

Last site update:
2020-01-20 19:03:37

Describe ClusterWideEvlogHowto here.

How to redirect linux-HA logging CTS wants with evlog

Related background introduction

  • evlog is a new logging system. It's open source, and its source/binary is licensed under GPL/LGPL. This is its homepage: evlog is compliance with draft POSIX Standard 1003.25. It can provide more advanced logging capacities (please refer to its web site for more details). Among its serveral important features, when comparing with syslog, the remote logging with tcp protocol is preferred here.

    Why? Because when testing linux-ha as described in ClusterTesting, you need to have remote logging support. Of course you can use syslog to get it via suitable setting as the steps descibed in ClusterWideSyslogHowto. But, syslog itself only supports remote logging with udp protocol. As you know, sometimes udp protocol is not reliable enough, and especially under heavy workload may lose some udp packages, cause cts' log to become a mess and difficult to analyse. Evlog is a good way to resolve this issue. Briefly, we can locally forward syslog message to evlog, then continue forwarding the log message to remote machine with evlog's tcp remote logging capacity. This don't require to rewrite related applications, such as heartbeat. It's a big advantage for us. Since by default evlog is not configured to support tcp remote logging, we need to configure it.

Get the evlog, build binary if needed

  • You can download evlog binary or source from the evlog project page

    at Some linux distributions, such as SLES, include evlog, but normally it doesn't contain the remote tcp logging module named tcp_rmtlog_be. So you may need to get additional package from there. You may get the suitable binary packages for your system from there. As for rpm package, you need

    • evlog -- standard package, including most functions
    • tcp_rmtlog_be -- module to support remote tcp logging
    If you have to build the binary for yourself, you can follow these steps. Here you begin from the evlog-1.5.3 tarball.
    • Download evlog-1.5.3.tar.gz
    • Untar the tarball: tar -xzvf evlog-1.5.3.tar.gz

    • Log in as root,
          cd evlog-1.5.3
          # run configuration scripts:
          # build and install:
          make install
          make startall
      Or build rpms, and install them:
          make rpm
          make rpm-tcp
          make rpm-udp
      Then you can see the evlog and tcp_rmtlog_be in the top level build directory. You can install them as usual with the rpm command.
    When installation was successful, you will see messages like these...
      /etc/init.d/evlog start
      Starting enterprise event logger:                          [  OK  ]
      /etc/init.d/evlogrmt start
      Starting remote event logger:                              [  OK  ]
      /etc/init.d/evlnotify start
      Starting enterprise event log notification:                [  OK  ]
      /etc/init.d/evlaction start
      Starting notification action daemon:                       [  OK  ]

Configure remote event consolidator, which normally run CTS test scripts

  • This procedure configures the evlogrmtd daemon to accept events from other hosts on the network, so that events from multiple hosts can be consolidated into a single log file.
    • Log in as root
    • Edit /etc/evlog.d/evlhosts to add an entry for each of two testing host that run heartbeat. Each entry must specify host name, either simple name or FQDN, and also a unique identifier for each host. This identifier can be up to 2 bytes, but cannot be equal to 0 (it will be ignored). For example:

          1          hatest1
          2          hatest2
    • There is also a configuration file, /etc/evlog.d/evlogrmtd.conf which contains the following as default:

      Password is used only by TCP clients to authenticate remote hosts when attempting to connect.

      TCPPort must match the TCP port used by other two test machines for sending events to the event consolidator.

    • Restart the evlogrmtd daemon: /etc/init.d/evlogrmt restart

    If evlogrmtd cannot resolve any of the hosts listed in evlhosts, or there are no entries in /etc/evlog.d/evlhosts, then the evlogmrtd will exit.

Configure the two test machine on which hearbeat will run

  • This procedure installs and configures an event tcp logging plugin for forwarding events to a remote event consolidator. The local logging software must be installed.
    • Log in as root.
    • If you have tcp_rmtlog_be intalled, then skip to next step. Otherwise,

      install it now: rpm -Uhv tcp_rmtlog_be-1.5.3-1.i386.rpm

    • edit /etc/evlog.d/plugins/tcp_rmtlog_be.conf; you need to specify the following items:

      • Remote Host -- IP address, or hostname for the event consolidator.

      • Port -- should match the port number used by the event consolidator.

      • Disable=no -- to send events using TCP

      • Password -- must match password expected by the event consolidator when the TCP connection is attempted.

      • BufferLenInKbytes -- Specifies the size of the memory buffer for events being transmitted via TCP. This reduces the chances of losing events during temporary loss of connection. Default size=128. Recommended range is 32 to 1024.

      A sample tcp_rmtlog_be.conf may look like this:
          Remote Host=
    • Restart the evlogd daemon to load the plugin: /etc/init.d/evlog restart

Configure syslog on the pair of HA machines

  • For forwarding syslog messages to the evlog on the same machine, issue this

    command, which is from evlog package: /sbin/slog_fwd This will forward syslog messages immediately, and after every subsequent

    reboot. To disable syslog forwarding: /sbin/slog_fwd -r

Test your configure work

  • For example, on one of the cluster machines, issue this command:

    logger -p "logging hello from hatest1" Then go to the remote event consolidator, which run CTS test scripts. Issue this command, which is from evlog package:

    evlview -m | grep hatest1. You should see its result: Apr  7 13:32:04 hadev1 logging hello from hatest1 Note, by default event log message of evlog is stored in the binary file

    /var/evlog/eventlog. You should use evlview to read it.

Enjoy evlog ;)