Hi,

Here is modified configuration file for central logging. I have tested it working in my environment.

Server.conf

#################################################################
source s_remote  { tcp(); };
## This will create seprate file for each client on central log server and log http messages
destination d_clients { file("/var/adm/web.$HOST.log"); };
log { source(s_remote); destination(d_clients); };
#################################################################

options {
sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
};

source s_sys {
file ("/proc/kmsg" log_prefix("kernel: "));
unix-stream ("/dev/log");
internal();
#udp(ip(0.0.0.0) port(514));
};

## This will log local http messages to defined file
destination send_http_logs { file("/var/log/web.log"); };

filter send_http_logs {
program("httpd.*");
};

log {
source(s_sys);
filter(send_http_logs);
destination(send_http_logs);
};

Client.conf


options {
           sync (0);
         time_reopen (10);

          log_fifo_size (1000);
          long_hostnames(on);
          use_dns(yes);
          dns_cache(yes);
          use_fqdn(no);
          create_dirs (yes);
          keep_hostname (yes);
          perm(0640);
          dir_perm(0750);
};

source s_sys {
   file ("/proc/kmsg" log_prefix("kernel: "));
   unix-stream ("/dev/log");
   internal();
};

destination send_http_logs { tcp("192.168.2.54" port(514)); };

filter send_http_logs {
program("httpd.*");
};

log {
source(s_sys);
filter(send_http_logs);
destination(send_http_logs);
};


Hope this will work for you.

--
Chanchal



lance raymond <lance.raymond@gmail.com>
Sent by: syslog-ng-bounces@lists.balabit.hu

01/29/2009 02:53 AM
Please respond to
"Syslog-ng users' and developers' mailing list"        <syslog-ng@lists.balabit.hu>

To
syslog-ng@lists.balabit.hu
cc
Subject
[syslog-ng] 1st post on some basic 101 setup





Basic scenario is we have 5 web servers in a cluster which I wish to centrally log.  I was pointed to syslog-ng and the linuxquestions guys 50+ readings and not 1 response so found this list and will give it a try.

Basically all the webservers are running FC5, and rpm -qa shows the following version;
syslog-ng-1.6.12-1.fc5

I see some newer versions, not sure if I should/have to, but really just want to log the different vhosts apache logs to a central server.  I read a few diff things a few places, and so far have the following conf files.  

Server.conf

options {
sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
};

source s_sys {
file ("/proc/kmsg" log_prefix("kernel: "));
unix-stream ("/dev/log");
internal();
udp(ip(0.0.0.0) port(514));
};

destination send_http_logs { file("/var/log/web.log"); };

filter send_http_logs {
program("httpd.*");
};

log {
source(s_sys);
filter(send_http_logs);
destination(send_http_logs);
};

Client.conf


options {
   sync (0);
   time_reopen (10);
   log_fifo_size (1000);
   long_hostnames (off);
   use_dns (no);
   use_fqdn (no);
   create_dirs (no);
   keep_hostname (yes);
};

source s_sys {
   file ("/proc/kmsg" log_prefix("kernel: "));
   unix-stream ("/dev/log");
   internal();
   # udp(ip(0.0.0.0) port(514));
};

destination send_http_logs { udp("192.168.2.54" port(514)); };

filter send_http_logs {
program("httpd.*");
};

log {
source(s_sys);
filter(send_http_logs);
destination(send_http_logs);
};

I restart the services and look for that web.log file and never see anything, so any help is appreciated.
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html