All I know is that it isn't creating that file for errors....The access one works. They still are not being forwarded. Is there something on my central syslog server I need to put in the config? Something that says....if this file comes in put it here?
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of David Lang Sent: Thursday, April 04, 2013 2:45 PM To: rsyslog-users Subject: Re: [rsyslog] httpd logs Then, unless you have something throwing logs away before that (some line matching the logs with a destination of ~), the logs will be forwarded. David Lang On Thu, 4 Apr 2013, Josh Bitto wrote: > Date: Thu, 4 Apr 2013 14:44:23 -0700 > From: Josh Bitto <[email protected]> > Reply-To: rsyslog-users <[email protected]> > To: rsyslog-users <[email protected]> > Subject: Re: [rsyslog] httpd logs > > Here is my config... > > I do have the *.* @destination already. > > > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of David Lang > Sent: Thursday, April 04, 2013 2:39 PM > To: rsyslog-users > Subject: Re: [rsyslog] httpd logs > > you need to add a line to forward the logs. > > Without seeing the rest of your configuration, we can't say if it's going to > be forwarded by an existing configuration. > > My personal belief is that logs are small enough bandwidth wise, and > rsyslog is fast enough that I tjust do > > *.* @destination > > (for UDP forwarding), adjust for other forwarding methods if needed) > > and then throw away logs I don't care about later. I find that too many times > logs that nobody thinks are important end up being critical to figuring out > some problem. So it's just easier to send and archive everything. > > David Lang > > > On Thu, 4 Apr 2013, Josh Bitto wrote: > >> Date: Thu, 4 Apr 2013 14:02:33 -0700 >> From: Josh Bitto <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> Subject: Re: [rsyslog] httpd logs >> >> Well ok so I followed the doc that explains how to setup httpd access and >> error logs to be configured to use rsyslog. I think it "mostly" works. I >> have a file that is created that is in /var/log/httpd-access.log which is on >> my remote machine. >> >> How do I get that to be forwarded to my central syslog server? >> >> Plus I think I did something wrong on rsyslog.conf about the errors. When I >> followed the instructions (even used the example given) nothing happens. >> >> >> >> >> -----Original Message----- >> From: [email protected] >> [mailto:[email protected]] On Behalf Of Josh Bitto >> Sent: Thursday, April 04, 2013 12:12 PM >> To: rsyslog-users ([email protected]) >> Subject: [rsyslog] httpd logs >> >> When setting rsyslog to obtain httpd logs I did the following: >> In httpd.conf >> ErrorLog syslog:local7 >> >> >> In rsyslog.conf >> Would I add the rule like this? >> >> Local1.err /var/log/apache.err >> >> Or for the file use any file name? And will this file be forwarded to my >> central syslog server. >> >> >> Joshua Bitto >> Information Technologist >> KCC >> >> >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This >> is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our >> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites >> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >> THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This > is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our > control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
