Hello Rainer, Thank you for the prompt response, the thing is Im running rsyslog on the log server, the other servers where apache is running has the standard syslog daemon running.
Any other hint? --- On Fri, 12/11/09, Rainer Gerhards <[email protected]> wrote: > From: Rainer Gerhards <[email protected]> > Subject: Re: [rsyslog] filter logger tags from syslog > To: "rsyslog-users" <[email protected]> > Date: Friday, December 11, 2009, 9:54 AM > See this, especially "splitting local > and remote logging" (especially the > traditional approach) > > http://www.rsyslog.com/doc-multi_ruleset.html > > Rainer > > > -----Original Message----- > > From: [email protected] > [mailto:rsyslog- > > [email protected]] > On Behalf Of Jose Sanchez > > Sent: Friday, December 11, 2009 4:41 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] filter logger tags from syslog > > > > Hello again, > > > > Everything is running pretty smooth after the solution > applied, I have > > noted just one thing, my /var/log/messages is > caughting all the logs > > (including the statistics log from apache) on each > server and due this > > the file goes up to 5-6GB every few days, is there > anyway to prevent > > the apache statistics to go to this log file? > > > > This is my syslog.conf > > > > ------------- > > # Log all kernel messages to the console. > > # Logging much else clutters up the screen. > > #kern.* > > /dev/console > > > > # Log anything (except mail) of level info or higher. > > # Don't log private authentication messages! > > > *.info;mail.none;authpriv.none;cron.none > /var/log/messages > > > > # The authpriv file has restricted access. > > authpriv.* > > /var/log/secure > > > > # Log all the mail messages in one place. > > mail.* > -/var/log/maillog > > > > > > # Log cron stuff > > cron.* > > /var/log/cron > > > > # Everybody gets emergency messages > > *.emerg > > * > > > > # Save news errors of level crit and higher in a > special file. > > uucp,news.crit > /var/log/spooler > > > > # Save boot messages also to boot.log > > local7.* > > /var/log/boot.log > > > > local1.* @rsyslog-server.domain.com > > ------------- > > > > Thank you in advance. > > > > > > --- On Sat, 11/28/09, [email protected] <[email protected]> > wrote: > > > > > From: [email protected] <[email protected]> > > > Subject: Re: [rsyslog] filter logger tags from > syslog > > > To: "rsyslog-users" <[email protected]> > > > Date: Saturday, November 28, 2009, 3:43 AM > > > On Fri, 27 Nov 2009, Jose Sanchez > > > wrote: > > > > > > > Hello David and Reiner, > > > > > > > > First I would like to thank you for all the > help > > > offered, I was able to setup almost everything > because of > > > you guys. > > > > > > > > I had some issues today, though. I found > that rsyslog > > > was removing the "logger" properly but it was > adding an > > > extra empty space not sure why so I had to cut if > off (by > > > watching how to do it on video tutorial first!) > by modifying > > > the template that David gave me, I currently have > it like > > > this, > > > > > > > > $template line,"%msg:2:1000%\n" > > > > > > > > The thing here is Im not sure if this is a > reliable > > > solution, I couldnt find if there is any setting > that will > > > tell rsyslog to simply remove the empty space or > to get > > > everything until the last letter so I configured > a very long > > > (1000) number in case rsyslog cuts some part of > the text. > > > Not sure if there is any negative impact on doing > it this > > > way, if there is any other better way, please let > me know. > > > > > > if you use '$' instead of '1000' it will go to > the end of > > > the message, no > > > matter how long it is (1000 is not long enough > for some > > > messages) > > > > > > I think that what you are doing is probably the > best way to > > > deal with > > > this space. > > > > > > David Lang > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
