[rsyslog] rsyslog with apache and per vhost log

Maurizio Rottin maurizio.rottin at gmail.com
Thu Mar 20 15:20:17 CET 2008

2008/3/13, Rainer Gerhards <rgerhards at hq.adiscon.com>:

> [sniiiiip]
> > Not really...i don't want to use logger, it becomes a heavy process
>  > under high traffic load....but this should be a question for the
>  > apache ML...
> OK, I don't know what makes it a heavy process... anyhow... If you come
>  up with an explanation or what would be less resource-intense (from an
>  apache point of view), please let me know. Maybe I can add a simple
>  little tool to do the job. But obviously I need to know what's wrong
>  with logger before even thinking about that ;)

ok my ideas are a little more clear now, as you said:
> was how you could use the same apache config command for each log, so
>  that you don't need to have separate apache config statements for each
>  virtual server?
>  Please bear with me if I am getting it wrong, I probably have too much
>  rsyslog on my mind. I am trying to help but I don't get a grip at what
>  the real problem is...

you were right...this is what i need!

just one command for ErrorLog and one for CustomLog

so as i posted now i'm using:
>  > this is the log part in the <virtualhost> directive
>  > ErrorLog "|/usr/bin/logger -p local5.err -t error_www.mysite.com"
>  > CustomLog "|/usr/bin/logger -p local6.info -t www.mysite.com "
>  > "combined"
>  >
>  > in practice i pass the ErrorLog and CustomLog to /usr/bin/logger with
>  > facility "-p local*.xxx" with tag "-t www.mysite.com"

for each virtualhost, but this mean that i have 2 loggers running for
every virtualhost.
This is why logger becomes a heavy process.

But if i use one default directive for every vhost, i don't know how
to split the log per vhost in the remote machine which collects the

Hope now is a little bit clearer...

now, new config in httpd.conf
"LogLevel warn
ErrorLog "|/usr/bin/logger -p local5.err"
LogFormat "%v %h %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vcombined
CustomLog "|/usr/bin/logger -p local6.info " vcombined"

and the %v gives the virtualhost name, so now i've got only two loggers.

At this point how can i say to rsyslog to split the files according to
the first word which is in this case the vhost name?

Thanks for being patient!


More information about the rsyslog mailing list