[rsyslog] Duplicate log entries with Apache+rsyslog

[Ryan Lynch]

On Thu, Dec 10, 2009 at 09:02,  <tronyx at tronyx.networkgimps.com> wrote:
> On the web server, the log directives are set as below:
>
> ErrorLog "|/usr/bin/logger -p local7.err -t error_domain.com"
> CustomLog "|/usr/bin/logger -p local6.info -t domain.com " "combined"

This is totally unrelated to your question, and I'm sure you have
reasons for it, but I'm curious about something: Why are you piping
ErrorLog to 'logger'?

Apache's CustomLog doesn't support writing directly to syslog, so you
do need to pipe it to 'logger'. But ErrorLog can do it: 'ErrorLog
syslog:local7'. Apache doesn't call an external program, it just makes
the syslog calls, itself. (No idea why Apache supports one and not the
other.)

I can think of two practical differences with your method, versus the
built-in Apache support:

 - You can use the syslog tag 'error_domain.com'. I don't think Apache
can specify a custom tag, like that, can it?
 - Syslog can't see the real severity levels that Apache associates
with its messages. ErrorLog messages can be err, crit, warn, info,
debug, etc., but I think 'logger' forces everything into a single
severity level (err, in this case).

I hope you don't mind my curiousity. I do something similar with my
Apache logs, and I'm always looking for outside input on alternatices
and good practices.

-Ryan