I think you understood me correctly. The local syslogd could actually be syslog-ng if you want, it doesn’t really matter (I use syslog-ng on both ends). It’s not too hard to implement (I did have to modify the source code of Snare in order to get AWStats to interpret the log files), but besides that it was pretty easy. As far as the load goes, I’m not really sure since right now the only 2 servers I’m using it on are not high load servers. I hope that helps.

 

Brian

 

From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Esquivel, Vicente
Sent: Monday, November 21, 2005 3:50 PM
To: Syslog-ng users' and developers' mailing list
Subject: RE: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie

 

Thanks for responding.

 

So let me make sure I am understanding what you suggested.

 

You said that I could run SnareApache on the servers running apache, then let Snare send the Apache access logs to the local syslog on that same server then have the syslogd on that server send them to  the centralized syslog server that is logging via syslog-ng?

 

So I take it that Apache can't do it any other way without something like Snare?

 

How much of a load does it add to a server and how difficult is it to implement?

 

Thanks!

Vince

 

 

From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Brian Bemis
Sent: Monday, November 21, 2005 2:39 PM
To: 'Syslog-ng users' and developers' mailing list'
Subject: RE: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie

For the error logs, logging to syslog (or syslog-ng) is built into Apache.

For the access logs, try SNARE for Apache:

http://www.intersectalliance.com/projects/SnareApache/index.html

You can use this in conjunction with syslog-ng. It will send you’re apache logs to the syslog daemon on the local system, then all you have to do it set up syslog-ng to forward the logs to a central server and separate them according to the server sending the logs. This is all built into syslog-ng.

 

b

 

 

From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Esquivel, Vicente
Sent: Monday, November 21, 2005 8:39 AM
To: Syslog-ng users' and developers' mailing list
Subject: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie

 

Hello all,

 

I am new to this list, I am seeking some help on how to setup syslog-ng as a central log server.  More importantly I am wanting to know how to log all of my Apache servers to the central log server, but also create separate logs for each of the systems.  For example I am looking to do something like this:

 

Apache1

/var/log/Apache1/httpd/access.log

/var/log/Apache1/httpd/error.log

 

Apache2

/var/log/Apache2/httpd/access.log

/var/log/Apache2/httpd/error.log

 

Apache3

/var/log/Apache3/httpd/access.log

/var/log/Apache3/httd/error.log

 

and so on.

 

Thanks all in advance

 

Vince