Hello, Disregard my previous email, I got confused with another server. The one having the message file so big is the one that runs rsyslog.
I will look at the suggestion and see how does it run. Thanks! --- On Fri, 12/11/09, Jose Sanchez <[email protected]> wrote: > From: Jose Sanchez <[email protected]> > Subject: Re: [rsyslog] filter logger tags from syslog > To: "rsyslog-users" <[email protected]> > Date: Friday, December 11, 2009, 2:45 PM > Hello Rainer, > > Thank you for the prompt response, the thing is Im running > rsyslog on the log server, the other servers where apache is > running has the standard syslog daemon running. > > Any other hint? > > --- On Fri, 12/11/09, Rainer Gerhards <[email protected]> > wrote: > > > From: Rainer Gerhards <[email protected]> > > Subject: Re: [rsyslog] filter logger tags from syslog > > To: "rsyslog-users" <[email protected]> > > Date: Friday, December 11, 2009, 9:54 AM > > See this, especially "splitting local > > and remote logging" (especially the > > traditional approach) > > > > http://www.rsyslog.com/doc-multi_ruleset.html > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] > > [mailto:rsyslog- > > > [email protected]] > > On Behalf Of Jose Sanchez > > > Sent: Friday, December 11, 2009 4:41 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] filter logger tags from > syslog > > > > > > Hello again, > > > > > > Everything is running pretty smooth after the > solution > > applied, I have > > > noted just one thing, my /var/log/messages is > > caughting all the logs > > > (including the statistics log from apache) on > each > > server and due this > > > the file goes up to 5-6GB every few days, is > there > > anyway to prevent > > > the apache statistics to go to this log file? > > > > > > This is my syslog.conf > > > > > > ------------- > > > # Log all kernel messages to the console. > > > # Logging much else clutters up the screen. > > > #kern.* > > > > /dev/console > > > > > > # Log anything (except mail) of level info or > higher. > > > # Don't log private authentication messages! > > > > > *.info;mail.none;authpriv.none;cron.none > > /var/log/messages > > > > > > # The authpriv file has restricted access. > > > authpriv.* > > > > /var/log/secure > > > > > > # Log all the mail messages in one place. > > > mail.* > > -/var/log/maillog > > > > > > > > > # Log cron stuff > > > cron.* > > > > /var/log/cron > > > > > > # Everybody gets emergency messages > > > *.emerg > > > > * > > > > > > # Save news errors of level crit and higher in a > > special file. > > > uucp,news.crit > > /var/log/spooler > > > > > > # Save boot messages also to boot.log > > > local7.* > > > > /var/log/boot.log > > > > > > local1.* @rsyslog-server.domain.com > > > ------------- > > > > > > Thank you in advance. > > > > > > > > > --- On Sat, 11/28/09, [email protected] <[email protected]> > > wrote: > > > > > > > From: [email protected] <[email protected]> > > > > Subject: Re: [rsyslog] filter logger tags > from > > syslog > > > > To: "rsyslog-users" <[email protected]> > > > > Date: Saturday, November 28, 2009, 3:43 AM > > > > On Fri, 27 Nov 2009, Jose Sanchez > > > > wrote: > > > > > > > > > Hello David and Reiner, > > > > > > > > > > First I would like to thank you for all > the > > help > > > > offered, I was able to setup almost > everything > > because of > > > > you guys. > > > > > > > > > > I had some issues today, though. I > found > > that rsyslog > > > > was removing the "logger" properly but it > was > > adding an > > > > extra empty space not sure why so I had to > cut if > > off (by > > > > watching how to do it on video tutorial > first!) > > by modifying > > > > the template that David gave me, I currently > have > > it like > > > > this, > > > > > > > > > > $template line,"%msg:2:1000%\n" > > > > > > > > > > The thing here is Im not sure if this > is a > > reliable > > > > solution, I couldnt find if there is any > setting > > that will > > > > tell rsyslog to simply remove the empty > space or > > to get > > > > everything until the last letter so I > configured > > a very long > > > > (1000) number in case rsyslog cuts some part > of > > the text. > > > > Not sure if there is any negative impact on > doing > > it this > > > > way, if there is any other better way, > please let > > me know. > > > > > > > > if you use '$' instead of '1000' it will go > to > > the end of > > > > the message, no > > > > matter how long it is (1000 is not long > enough > > for some > > > > messages) > > > > > > > > I think that what you are doing is probably > the > > best way to > > > > deal with > > > > this space. > > > > > > > > David Lang > > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
