rsyslog

[Tom H]

On Tue, May 3, 2016 at 9:37 AM, Daniel Eschner <daniel at linux-nerd.de> wrote:
>
> i try to configure rsyslog als central syslog server für my internal stuff.
>
> I configured something like:
>
> $template apacheAccess,"/logs/%HOSTNAME%/apache_access_log"
>
> if $syslogtag == 'apache' then {
> local6.info ?apacheAccess
> & ~
> }
>
> but i see all messages only in syslog like:
>
> May 2 22:25:47 test-logger apache: 192.168.88.14 - - [02/May/2016:22:25:47
> +0200] "GET / HTTP/1.1" 200 3594 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X
> 10_11_4) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1
> Safari/601.5.17"
> May 2 22:25:47 test-logger apache: 192.168.88.14 - - [02/May/2016:22:25:47
> +0200] "GET / HTTP/1.1" 200 3594 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X
> 10_11_4) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1
> Safari/601.5.17"
> May 2 22:25:47 test-logger apache: 192.168.88.14 - - [02/May/2016:22:25:47
> +0200] "GET /icons/ubuntu-logo.png HTTP/1.1" 304 180 "http://192.168.71.21/"
> "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/601.5.17
> (KHTML, like Gecko) Version/9.1 Safari/601.5.1
>
> anyone a idea why it happend not is not shown in the log file which i want
> to have?

In apache's config:

CustomLog "|/bin/sh -c '/usr/bin/logger -p local6.info'" combined

You don't need the "sh" call if you're using apache v2.2, but you do
for apache v2.4 and you'll get (if you keep the standard CustomLog
line too):

# grep local6 syslog
May  3 12:33:50 local4.info  127.0.0.1 - - [03/May/2016:12:33:50
-0400] "GET / HTTP/1.1" 200 3525 "-" "Links (2.12; Linux
4.4.0-22-generic x86_64; GNU C 5.3.1; text)"

# cat apache2/access.log
127.0.0.1 - - [03/May/2016:12:33:50 -0400] "GET / HTTP/1.1" 200 3525
"-" "Links (2.12; Linux 4.4.0-22-generic x86_64; GNU C 5.3.1; text)"

(I'm using local4 in this VM but it's the same.)