Hi Ben,
yes I have a working example (this worked one year ago on Ubuntu Server
with rsyslog 5.8).
On the Webserver I defined a target in /etc/rsyslog.d/05-apache2.conf
# send apache logfiles over TCP (@@)
if $app-name == 'w' and $syslogfacility-text == 'local0' then
@@logserver.intern:514
if $app-name == 'w' and $syslogfacility-text == 'local0' then ~
# ssl logs on local1
if $app-name == 'w' and $syslogfacility-text == 'local1' then
@@logserver.intern:514
if $app-name == 'w' and $syslogfacility-text == 'local1' then ~
In my vHost config I defined another custom and errorlog.
<VirtualHost *:80>
ServerName www.example.com
# log on logserver
ErrorLog "|/usr/bin/logger -p local0.err -t w[www.example.com]"
CustomLog "|/usr/bin/logger -p local0.info -t w[www.example.com]"
combined
I did the same for my SSL vHost.
On the logserver I created template in /etc/rsyslog.d/05-apache.conf:
$template ApacheAccessLogFile,
"/data/logs/apache2/%procid%/%procid%_access_log"
$template ApacheErrorLogFile,
"/data/logs/apache2/%procid%/%procid%_error_log"
# SSL-Logfiles.
$template ApacheSSLAccessLogFile,
"/data/logs/apache2/%procid%/%procid%-ssl_access_log"
$template ApacheSSLErrorLogFile,
"/data/logs/apache2/%procid%/%procid%-ssl_error_log"
$template ApacheAccessLogFormat, "%msg:2:$:drop-last-lf%\r\n"
$template ApacheErrorLogFormat, "%msg:2:$:drop-last-lf%\r\n"
# define destination
if $app-name == 'w' and $syslogfacility-text == 'local0' and
$syslogseverity-text == 'info' then
-?ApacheAccessLogFile;ApacheAccessLogFormat
if $app-name == 'w' and $syslogfacility-text == 'local1' and
$syslogseverity-text == 'info' then
-?ApacheSSLAccessLogFile;ApacheAccessLogFormat
# deactivate destination
if $app-name == 'w' and $syslogfacility-text == 'local0' and
$syslogseverity-text == 'info' then ~
if $app-name == 'w' and $syslogfacility-text == 'local1' and
$syslogseverity-text == 'info' then ~
# the same for error logs
if $app-name == 'w' and $syslogfacility-text == 'local0' and
$syslogseverity-text == 'err' then
-?ApacheErrorLogFile;ApacheErrorLogFormat
if $app-name == 'w' and $syslogfacility-text == 'local1' and
$syslogseverity-text == 'err' then
-?ApacheSSLErrorLogFile;ApacheErrorLogFormat
# deactivate destination
if $app-name == 'w' and $syslogfacility-text == 'local0' and
$syslogseverity-text == 'err' then ~
if $app-name == 'w' and $syslogfacility-text == 'local1' and
$syslogseverity-text == 'err' then ~
You have to turn off RepeatedMsgReduction and activate the tcp
reception. I also activated imuxsock and imklog.
That's all I did.
I will have to setup another server like this on an actual Ubuntu in
the next days and can povide Informations what has changed in the
meantime
Rgds,
Axel
Am 10.12.2012 10:42, schrieb Ben Bradley:
On Fri, 07 Dec 2012 13:39:10 +0100
Axel <[email protected]> wrote:
Hi Ben,
you can use a syslogtag to separate one vHost from another in your
vHost log directive.
You have to cretae a template on your logserver which stores your
logfiles separated by your syslogtag
rgds
Axel
Hi Axel
Do you have a working example of this?
Is the syslogtag added in rsyslog or do you mean tell Apache to log
directly to syslog?
It seems like the main way to get Apache to log to both file and
syslog is...
http://serverfault.com/questions/385414/apache-httpd-send-error-logs-to-syslog-and-local-disk-without-touching-etc-sy
Or through a Perl script such as this...
http://www.oreillynet.com/pub/a/sysadmin/2006/10/12/httpd-syslog.html
It would be great to be able to achieve this without much changing of
Apache config.
Thanks for the info!
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
POST
if you DON'T LIKE THAT.
--
Never argue with an idiot; people watching may not tell the difference
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
