On Tue, Oct 04, 2005 at 09:15:32AM -0400, Brian Akins wrote: > Why not just replace mod_log_config rather than plug into it. > > Because mod_log_config handles a bunch of stuff for us. May be a > better solution would be to use the standard log_config way of > replacing init and writer and replace them with a pluggable one.
O.k., well if people really want to do this, using schemes and providers is an elegant way, we would just have to signpost the road to handling the formats. > >Though if all of this text parsing is getting expensive, I wonder would > >anyone be interested in a protocol for binary logging from httpd? > > Hmmm. interesting. Especially for things like spread, this would make > alot of sense. Whether it represents even more encoding or not is hard to tell though :) > >>CustomLog /logs/site.sock common > > > >You re-implemented syslog :-) I've done the same myself for our hosting > >service, we use syslog-ng to do all sorts of weird things with the info. > > but syslog can't, on it's own, determine between virtuals (same problems > as piped loggers). I may have to look at syslog-ng. Can you maybe > off-list share some of your techniques? Once you see syslog-ng's way of doing things, it becomes fairly self-explanatory; We use its regular expression engine for logging vhosts seperately and so on, but we also have a centralised log file which logs everything we consider important (which is basically errors we have not explicitly filtered out) accross all hosts. We also use its mysql output features to put this later class of logging information in a transient database, so that we can integrate and monitor the important, potentially critical, events within our NMS more easily. -- Colm MacCárthaigh Public Key: [EMAIL PROTECTED]
