Took me a while to understand what you were saying....but I removed if $syslogfacility-text == 'local6' and $programname == 'httpd' then ~
And it logs the other file now. They are being forwarded :D -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of David Lang Sent: Thursday, April 04, 2013 3:28 PM To: rsyslog-users Subject: Re: [rsyslog] httpd logs On Thu, 4 Apr 2013, Josh Bitto wrote: > All I know is that it isn't creating that file for errors....The > access one works. They still are not being forwarded. Is there > something on my central syslog server I need to put in the config? > Something that says....if this file comes in put it here? I'm not understanding, what file do you think it should be creating? each syslog server needs to have a rule of what to do with log messages, if no message matches, that syslog server will just ignore the log message. *.* @dest is a rule that matches everything, but in your configuration, you have rules that anything with local5 or local7 that has http as the program name will be thrown away before you get down to the *.* @dest rule David Lang > > > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of David Lang > Sent: Thursday, April 04, 2013 2:45 PM > To: rsyslog-users > Subject: Re: [rsyslog] httpd logs > > Then, unless you have something throwing logs away before that (some line > matching the logs with a destination of ~), the logs will be forwarded. > > David Lang > > On Thu, 4 Apr 2013, Josh Bitto wrote: > >> Date: Thu, 4 Apr 2013 14:44:23 -0700 >> From: Josh Bitto <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> Subject: Re: [rsyslog] httpd logs >> >> Here is my config... >> >> I do have the *.* @destination already. >> >> >> >> -----Original Message----- >> From: [email protected] >> [mailto:[email protected]] On Behalf Of David Lang >> Sent: Thursday, April 04, 2013 2:39 PM >> To: rsyslog-users >> Subject: Re: [rsyslog] httpd logs >> >> you need to add a line to forward the logs. >> >> Without seeing the rest of your configuration, we can't say if it's going to >> be forwarded by an existing configuration. >> >> My personal belief is that logs are small enough bandwidth wise, and >> rsyslog is fast enough that I tjust do >> >> *.* @destination >> >> (for UDP forwarding), adjust for other forwarding methods if needed) >> >> and then throw away logs I don't care about later. I find that too many >> times logs that nobody thinks are important end up being critical to >> figuring out some problem. So it's just easier to send and archive >> everything. >> >> David Lang >> >> >> On Thu, 4 Apr 2013, Josh Bitto wrote: >> >>> Date: Thu, 4 Apr 2013 14:02:33 -0700 >>> From: Josh Bitto <[email protected]> >>> Reply-To: rsyslog-users <[email protected]> >>> To: rsyslog-users <[email protected]> >>> Subject: Re: [rsyslog] httpd logs >>> >>> Well ok so I followed the doc that explains how to setup httpd access and >>> error logs to be configured to use rsyslog. I think it "mostly" works. I >>> have a file that is created that is in /var/log/httpd-access.log which is >>> on my remote machine. >>> >>> How do I get that to be forwarded to my central syslog server? >>> >>> Plus I think I did something wrong on rsyslog.conf about the errors. When I >>> followed the instructions (even used the example given) nothing happens. >>> >>> >>> >>> >>> -----Original Message----- >>> From: [email protected] >>> [mailto:[email protected]] On Behalf Of Josh Bitto >>> Sent: Thursday, April 04, 2013 12:12 PM >>> To: rsyslog-users ([email protected]) >>> Subject: [rsyslog] httpd logs >>> >>> When setting rsyslog to obtain httpd logs I did the following: >>> In httpd.conf >>> ErrorLog syslog:local7 >>> >>> >>> In rsyslog.conf >>> Would I add the rule like this? >>> >>> Local1.err /var/log/apache.err >>> >>> Or for the file use any file name? And will this file be forwarded to my >>> central syslog server. >>> >>> >>> Joshua Bitto >>> Information Technologist >>> KCC >>> >>> >>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: >>> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites >>> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >>> THAT. >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >>> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>> LIKE THAT. >>> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This >> is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our >> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
