Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: RSyslog: users

rsyslog and apache

 

 

RSyslog users RSS feed   Index | Next | Previous | View Threaded


f.sordillo at cineca

Jan 19, 2012, 5:59 AM

Post #1 of 6 (1889 views)
Permalink
rsyslog and apache

Hi to all.

I configured Apache to log with logger and rsyslog. In Apache I have

--------
ErrorLog "|/bin/logger -p local5.info -t http_myservice-error_log"
CustomLog "|/bin/logger -p local5.info -t http_myservice-access_log" common
-------

and my rsyslog.conf

-------
#Log apache
$template ApacheLog,"%msg:2:$:drop-last-lf%\r\n"
$template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%.log"

:syslogtag,startswith,"http" -?ArchiveApache;ApacheLog
:syslogtag,startswith,"http" ~
-------

So apache log are created inside /vag/log/httpd/ directory and it works
fine! But _all_ the files for each service are created within the
directory /var/log/httpd/.
So now, I need to create a specific directory inside /var/log/http/ for
each service configured inside apache. For example:
- /var/log/httpd/service1/ (error and access log)
- /var/log/httpd/service2/ (error and access log)
- /var/log/httpd/service3/ (error and access log)
and so on...

I'm a new with this tool, so how can I configure rsyslog and apache to
do that? Note that the number of services is not predictable.
Anyone can help me?

Thanks a lot!
Francesco.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/


david at lang

Jan 19, 2012, 11:47 PM

Post #2 of 6 (1871 views)
Permalink
Re: rsyslog and apache [In reply to]

On Thu, 19 Jan 2012, Francesco Sordillo wrote:

> Hi to all.
>
> I configured Apache to log with logger and rsyslog. In Apache I have
>
> --------
> ErrorLog "|/bin/logger -p local5.info -t http_myservice-error_log"
> CustomLog "|/bin/logger -p local5.info -t http_myservice-access_log" common
> -------
>
> and my rsyslog.conf
>
> -------
> #Log apache
> $template ApacheLog,"%msg:2:$:drop-last-lf%\r\n"
> $template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%.log"
>
> :syslogtag,startswith,"http" -?ArchiveApache;ApacheLog
> :syslogtag,startswith,"http" ~
> -------
>
> So apache log are created inside /vag/log/httpd/ directory and it works fine!
> But _all_ the files for each service are created within the directory
> /var/log/httpd/.
> So now, I need to create a specific directory inside /var/log/http/ for each
> service configured inside apache. For example:
> - /var/log/httpd/service1/ (error and access log)
> - /var/log/httpd/service2/ (error and access log)
> - /var/log/httpd/service3/ (error and access log)
> and so on...
>
> I'm a new with this tool, so how can I configure rsyslog and apache to do
> that? Note that the number of services is not predictable.
> Anyone can help me?

change your template to have a variable portion in the path, not just in
the file.

for example

$template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%/file.log"

would create a directory for each thing that was previously a file and in
that directory would be a file called "file.log"

if you want both the directory and filename to be variable, just defien
the appropriate variables in each.

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/


f.sordillo at cineca

Jan 20, 2012, 1:28 AM

Post #3 of 6 (1873 views)
Permalink
Re: rsyslog and apache [In reply to]

Il 20/01/2012 08:47, david [at] lang ha scritto:
> On Thu, 19 Jan 2012, Francesco Sordillo wrote:
>
>> Hi to all.
>>
>> I configured Apache to log with logger and rsyslog. In Apache I have
>>
>> --------
>> ErrorLog "|/bin/logger -p local5.info -t http_myservice-error_log"
>> CustomLog "|/bin/logger -p local5.info -t http_myservice-access_log"
>> common
>> -------
>>
>> and my rsyslog.conf
>>
>> -------
>> #Log apache
>> $template ApacheLog,"%msg:2:$:drop-last-lf%\r\n"
>> $template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%.log"
>>
>> :syslogtag,startswith,"http" -?ArchiveApache;ApacheLog
>> :syslogtag,startswith,"http" ~
>> -------
>>
>> So apache log are created inside /vag/log/httpd/ directory and it
>> works fine! But _all_ the files for each service are created within
>> the directory /var/log/httpd/.
>> So now, I need to create a specific directory inside /var/log/http/
>> for each service configured inside apache. For example:
>> - /var/log/httpd/service1/ (error and access log)
>> - /var/log/httpd/service2/ (error and access log)
>> - /var/log/httpd/service3/ (error and access log)
>> and so on...
>>
>> I'm a new with this tool, so how can I configure rsyslog and apache to
>> do that? Note that the number of services is not predictable.
>> Anyone can help me?
>
> change your template to have a variable portion in the path, not just in
> the file.
>
> for example
>
> $template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%/file.log"
>
> would create a directory for each thing that was previously a file and
> in that directory would be a file called "file.log"
>
> if you want both the directory and filename to be variable, just defien
> the appropriate variables in each.

Hi David.
Thanks a lot for your reply.
Could you please explain the last suggestion? How can I have error.log
and access.log defining two variable?
Thanks.
Francesco.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/


f.sordillo at cineca

Jan 20, 2012, 6:28 AM

Post #4 of 6 (1871 views)
Permalink
Re: rsyslog and apache [In reply to]

Il 20/01/2012 08:47, david [at] lang ha scritto:
> On Thu, 19 Jan 2012, Francesco Sordillo wrote:
>
>> Hi to all.
>>
>> I configured Apache to log with logger and rsyslog. In Apache I have
>>
>> --------
>> ErrorLog "|/bin/logger -p local5.info -t http_myservice-error_log"
>> CustomLog "|/bin/logger -p local5.info -t http_myservice-access_log"
>> common
>> -------
>>
>> and my rsyslog.conf
>>
>> -------
>> #Log apache
>> $template ApacheLog,"%msg:2:$:drop-last-lf%\r\n"
>> $template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%.log"
>>
>> :syslogtag,startswith,"http" -?ArchiveApache;ApacheLog
>> :syslogtag,startswith,"http" ~
>> -------
>>
>> So apache log are created inside /vag/log/httpd/ directory and it
>> works fine! But _all_ the files for each service are created within
>> the directory /var/log/httpd/.
>> So now, I need to create a specific directory inside /var/log/http/
>> for each service configured inside apache. For example:
>> - /var/log/httpd/service1/ (error and access log)
>> - /var/log/httpd/service2/ (error and access log)
>> - /var/log/httpd/service3/ (error and access log)
>> and so on...
>>
>> I'm a new with this tool, so how can I configure rsyslog and apache to
>> do that? Note that the number of services is not predictable.
>> Anyone can help me?
>
> change your template to have a variable portion in the path, not just in
> the file.
>
> for example
>
> $template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%/file.log"
>
> would create a directory for each thing that was previously a file and
> in that directory would be a file called "file.log"
>
> if you want both the directory and filename to be variable, just defien
> the appropriate variables in each.
>
> David Lang

I think I got a way out... using parsing of syslog tag. I changed my
apache configuration as

----------
ErrorLog "|/bin/logger -p local5.info -t
service1_http_www.service1.it_error_log"
CustomLog "|/bin/logger -p local5.info -t
service1_http_www.service1.it_access_log" common
----------

and in rsyslog.conf I used properties replacer to create service
directory inside /var/log/httpd/ and error.log and access.log

---------
$template ApacheLog,"%msg:2:$:drop-last-lf%\r\n"
/%syslogtag:F,95:2+%"
$template
ArchiveApache,"/var/log/httpd/%syslogtag:F,95:1%/%syslogtag:R,ERE,0,FIELD:http(.*)[^\:]--end%"

:syslogtag,contains,"http" -?ArchiveApache;ApacheLog
:syslogtag,contains,"http" ~
----------

Looks at:
- "%syslogtag:F,95:1%": it splits the syslog tag extracting the
"service1" name (to create /var/log/https/service1 directory)
- "%syslogtag:R,ERE,0,FIELD:http(.*)[^\:]--end%": it splits the syslog
tag removing "service1" from the begin of the string and ":" character
from the end (to create http_www.service1.it_error.log or access.log).

What do yuo think about? Is there a more elegant solution?
Thanks a lot.
Francesco
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/


david at lang

Jan 20, 2012, 11:22 AM

Post #5 of 6 (1879 views)
Permalink
Re: rsyslog and apache [In reply to]

On Fri, 20 Jan 2012, Francesco Sordillo wrote:

> Il 20/01/2012 08:47, david [at] lang ha scritto:
>> On Thu, 19 Jan 2012, Francesco Sordillo wrote:
>>
>>> Hi to all.
>>>
>>> I configured Apache to log with logger and rsyslog. In Apache I have
>>>
>>> --------
>>> ErrorLog "|/bin/logger -p local5.info -t http_myservice-error_log"
>>> CustomLog "|/bin/logger -p local5.info -t http_myservice-access_log"
>>> common
>>> -------
>>>
>>> and my rsyslog.conf
>>>
>>> -------
>>> #Log apache
>>> $template ApacheLog,"%msg:2:$:drop-last-lf%\r\n"
>>> $template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%.log"
>>>
>>> :syslogtag,startswith,"http" -?ArchiveApache;ApacheLog
>>> :syslogtag,startswith,"http" ~
>>> -------
>>>
>>> So apache log are created inside /vag/log/httpd/ directory and it
>>> works fine! But _all_ the files for each service are created within
>>> the directory /var/log/httpd/.
>>> So now, I need to create a specific directory inside /var/log/http/
>>> for each service configured inside apache. For example:
>>> - /var/log/httpd/service1/ (error and access log)
>>> - /var/log/httpd/service2/ (error and access log)
>>> - /var/log/httpd/service3/ (error and access log)
>>> and so on...
>>>
>>> I'm a new with this tool, so how can I configure rsyslog and apache to
>>> do that? Note that the number of services is not predictable.
>>> Anyone can help me?
>>
>> change your template to have a variable portion in the path, not just in
>> the file.
>>
>> for example
>>
>> $template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%/file.log"
>>
>> would create a directory for each thing that was previously a file and
>> in that directory would be a file called "file.log"
>>
>> if you want both the directory and filename to be variable, just defien
>> the appropriate variables in each.
>>
>> David Lang
>
> I think I got a way out... using parsing of syslog tag. I changed my apache
> configuration as
>
> ----------
> ErrorLog "|/bin/logger -p local5.info -t
> service1_http_www.service1.it_error_log"
> CustomLog "|/bin/logger -p local5.info -t
> service1_http_www.service1.it_access_log" common
> ----------
>
> and in rsyslog.conf I used properties replacer to create service directory
> inside /var/log/httpd/ and error.log and access.log
>
> ---------
> $template ApacheLog,"%msg:2:$:drop-last-lf%\r\n"
> /%syslogtag:F,95:2+%"
> $template
> ArchiveApache,"/var/log/httpd/%syslogtag:F,95:1%/%syslogtag:R,ERE,0,FIELD:http(.*)[^\:]--end%"
>
> :syslogtag,contains,"http" -?ArchiveApache;ApacheLog
> :syslogtag,contains,"http" ~
> ----------
>
> Looks at:
> - "%syslogtag:F,95:1%": it splits the syslog tag extracting the "service1"
> name (to create /var/log/https/service1 directory)
> - "%syslogtag:R,ERE,0,FIELD:http(.*)[^\:]--end%": it splits the syslog tag
> removing "service1" from the begin of the string and ":" character from the
> end (to create http_www.service1.it_error.log or access.log).
>
> What do yuo think about? Is there a more elegant solution?
> Thanks a lot.

this is the right approach.

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/


ar at xlrs

Jan 21, 2012, 11:19 AM

Post #6 of 6 (1873 views)
Permalink
Re: rsyslog and apache [In reply to]

Am Donnerstag 19 Januar 2012, 14:59:31 schrieb Francesco Sordillo:
> Hi to all.
>
> I configured Apache to log with logger and rsyslog. In Apache I have
>
> --------
> ErrorLog "|/bin/logger -p local5.info -t http_myservice-error_log"
> CustomLog "|/bin/logger -p local5.info -t http_myservice-access_log" common
> -------

When you use different facilities there's no need to parse and split the
syslogtag.
Just a suggestion...

Regards,
Axel



--
Never argue with an idiot; people watching may not tell the difference
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

RSyslog users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.