Ok so I figured out why it wasn't working...local7 is already being used in the config for a default rule...so I changed that to local5
It still isn't forwarding.... _____________________________________________ From: Josh Bitto Sent: Friday, April 05, 2013 1:44 PM To: rsyslog-users ([email protected]) Subject: httpd logs can't get error log to work So I used the instructions per here... http://wiki.rsyslog.com/index.php/Working_Apache_and_Rsyslog_configuration I have a nifty access and error logs in /var/log/httpd-access.log /var/log/httpd-error.log Ok so that all good and dandy.....In the instructions I kept the same local 6 and 7 in the configuration. They are being forwarded to a central log server per forwarding rule. In my rsysconfig.conf I have: if $syslogfacility-text == 'local6' and $programname == 'httpd' then /var/log/httpd-access.log if $syslogfacility-text == 'local7' and $programname == 'httpd' then /var/log/httpd-error.log On the central server I have this: (not the whole config, but just the statements that pertain to the above.) $template httpdaccess,"/var/log/hosts/%HOSTNAME%/httpd-access.log" $template httpderror,"/var/log/hosts/%HOSTNAME%/httpd-error.log" if \ $source != 'syslog.onlineschool.ca' \ and \ $syslogseverity <= '6' \ and ( \ $syslogfacility-text != 'mail' \ and \ $syslogfacility-text != 'authpriv' \ and \ $syslogfacility-text != 'cron' \ and \ $programname != 'mysqld' \ and \ $programname != 'httpd' \ ) \ then ?DYNmessages if \ $source != 'syslog.onlineschool.ca' \ and \ $programname == 'httpd' \ and \ $syslogfacility-text == 'local6' \ then ?httpdaccess if \ $source != 'syslog.onlineschool.ca' \ and \ $programname != 'httpd' \ and \ $syslogfacility-text == 'local7' \ then ?httpderror The access one works...but the error log does not. Any ideas? Joshua Bitto Information Technologist KCC _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
