david at lang
Jan 20, 2012, 11:22 AM
Post #5 of 6
(1066 views)
Permalink
|
On Fri, 20 Jan 2012, Francesco Sordillo wrote:
> Il 20/01/2012 08:47, david [at] lang ha scritto:
>> On Thu, 19 Jan 2012, Francesco Sordillo wrote:
>>
>>> Hi to all.
>>>
>>> I configured Apache to log with logger and rsyslog. In Apache I have
>>>
>>> --------
>>> ErrorLog "|/bin/logger -p local5.info -t http_myservice-error_log"
>>> CustomLog "|/bin/logger -p local5.info -t http_myservice-access_log"
>>> common
>>> -------
>>>
>>> and my rsyslog.conf
>>>
>>> -------
>>> #Log apache
>>> $template ApacheLog,"%msg:2:$:drop-last-lf%\r\n"
>>> $template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%.log"
>>>
>>> :syslogtag,startswith,"http" -?ArchiveApache;ApacheLog
>>> :syslogtag,startswith,"http" ~
>>> -------
>>>
>>> So apache log are created inside /vag/log/httpd/ directory and it
>>> works fine! But _all_ the files for each service are created within
>>> the directory /var/log/httpd/.
>>> So now, I need to create a specific directory inside /var/log/http/
>>> for each service configured inside apache. For example:
>>> - /var/log/httpd/service1/ (error and access log)
>>> - /var/log/httpd/service2/ (error and access log)
>>> - /var/log/httpd/service3/ (error and access log)
>>> and so on...
>>>
>>> I'm a new with this tool, so how can I configure rsyslog and apache to
>>> do that? Note that the number of services is not predictable.
>>> Anyone can help me?
>>
>> change your template to have a variable portion in the path, not just in
>> the file.
>>
>> for example
>>
>> $template ArchiveApache,"/var/log/httpd/%syslogtag:F,58:1%/file.log"
>>
>> would create a directory for each thing that was previously a file and
>> in that directory would be a file called "file.log"
>>
>> if you want both the directory and filename to be variable, just defien
>> the appropriate variables in each.
>>
>> David Lang
>
> I think I got a way out... using parsing of syslog tag. I changed my apache
> configuration as
>
> ----------
> ErrorLog "|/bin/logger -p local5.info -t
> service1_http_www.service1.it_error_log"
> CustomLog "|/bin/logger -p local5.info -t
> service1_http_www.service1.it_access_log" common
> ----------
>
> and in rsyslog.conf I used properties replacer to create service directory
> inside /var/log/httpd/ and error.log and access.log
>
> ---------
> $template ApacheLog,"%msg:2:$:drop-last-lf%\r\n"
> /%syslogtag:F,95:2+%"
> $template
> ArchiveApache,"/var/log/httpd/%syslogtag:F,95:1%/%syslogtag:R,ERE,0,FIELD:http(.*)[^\:]--end%"
>
> :syslogtag,contains,"http" -?ArchiveApache;ApacheLog
> :syslogtag,contains,"http" ~
> ----------
>
> Looks at:
> - "%syslogtag:F,95:1%": it splits the syslog tag extracting the "service1"
> name (to create /var/log/https/service1 directory)
> - "%syslogtag:R,ERE,0,FIELD:http(.*)[^\:]--end%": it splits the syslog tag
> removing "service1" from the begin of the string and ":" character from the
> end (to create http_www.service1.it_error.log or access.log).
>
> What do yuo think about? Is there a more elegant solution?
> Thanks a lot.
this is the right approach.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
|
