Collating Event Log Files - HP P4535A - Web Cache Server Appliance Administrator's Manual

Chapter 12

Collating event log files

You can use Traffic Server's log file collation feature to keep all logged information in one place. This allows
you to analyze Traffic Server as a whole rather than as individual nodes and to use a large disk that may only
be located on one of the nodes in a cluster.
Traffic Server collates log files by using one or more nodes as log collation servers and all remaining nodes
as log collation clients. When a Traffic Server node generates a buffer of event log entries, it determines
whether it is the collation server or a collation client. The collation server node simply writes all log buffers
to its local disk, just as it would if log collation were not enabled.
The collation client nodes prepare their log buffers for transfer across the network and send the buffers to the
log collation server. When the log collation server receives a log buffer from a client, it writes it to its own log
file as if it were generated locally. See Figure 12-1.
If log clients cannot contact their log collation server, they write their log buffers to their local disks, into
orphan log files. Orphan log files require manual collation. See Figure 12-2.
Figure 12-2. Orphan log files hold data that cannot be written to the log server
Log collation servers may be stand-alone or they may be part of a node running Traffic Server.
NOTE
Node 1
Log
Node 2
Log
Node 3
Log
Node 4
Log
Figure 12-1. Log collation
Node 1
Log
Orphan Log File
Node 2
Log
Node 3 Orphan Log File
Log
Node 4 Orphan Log File
Log
Orphan Log File
Log collation may have an impact on network performance. Because all nodes are
forwarding their log data buffers to the single collation server, a bottleneck may occur in
the network, where the amount of data being sent to a single node in the network
exceeds the node's ability to process it quickly.
Working with Log Files
Master Log
Log
Node 5
(log collation server)
Log Collation
Server
115