[rsyslog] rsyslog with apache and per vhost log

Maurizio Rottin maurizio.rottin at gmail.com
Thu Mar 20 15:20:17 CET 2008


2008/3/13, Rainer Gerhards <rgerhards at hq.adiscon.com>:

wow,
> [sniiiiip]
>
> > Not really...i don't want to use logger, it becomes a heavy process
>  > under high traffic load....but this should be a question for the
>  > apache ML...
>
>
> OK, I don't know what makes it a heavy process... anyhow... If you come
>  up with an explanation or what would be less resource-intense (from an
>  apache point of view), please let me know. Maybe I can add a simple
>  little tool to do the job. But obviously I need to know what's wrong
>  with logger before even thinking about that ;)
>
>

ok my ideas are a little more clear now, as you said:
> was how you could use the same apache config command for each log, so
>  that you don't need to have separate apache config statements for each
>  virtual server?
>
>  Please bear with me if I am getting it wrong, I probably have too much
>  rsyslog on my mind. I am trying to help but I don't get a grip at what
>  the real problem is...
>
>

you were right...this is what i need!

just one command for ErrorLog and one for CustomLog

so as i posted now i'm using:
>  > this is the log part in the <virtualhost> directive
>  > ErrorLog "|/usr/bin/logger -p local5.err -t error_www.mysite.com"
>  > CustomLog "|/usr/bin/logger -p local6.info -t www.mysite.com "
>  > "combined"
>  >
>  > in practice i pass the ErrorLog and CustomLog to /usr/bin/logger with
>  > facility "-p local*.xxx" with tag "-t www.mysite.com"

for each virtualhost, but this mean that i have 2 loggers running for
every virtualhost.
This is why logger becomes a heavy process.

But if i use one default directive for every vhost, i don't know how
to split the log per vhost in the remote machine which collects the
logs...

Hope now is a little bit clearer...

now, new config in httpd.conf
"LogLevel warn
ErrorLog "|/usr/bin/logger -p local5.err"
LogFormat "%v %h %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vcombined
CustomLog "|/usr/bin/logger -p local6.info " vcombined"

and the %v gives the virtualhost name, so now i've got only two loggers.

At this point how can i say to rsyslog to split the files according to
the first word which is in this case the vhost name?

Thanks for being patient!

-- 
mr



More information about the rsyslog mailing list