My goal is to enable Apache to log large access_log entries (> 1024 chars) to a syslog-ng server. The vast majority of examples I've seen for connecting Apache to syslog-ng employ the ancient /usr/bin/logger -- but that approach chops up messages longer than 1024 chars. The alternative approach is to use a perl/python script, but I'm nervous about the overhead. Anyone know of an updated logger binary? Thanks for any pointers, -Brian
Would using syslog-ng directly work? (pointing it at the access_log file) Jim -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Brian Donaldson Sent: Thursday, February 04, 2010 8:01 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Apache + syslog-ng w/o logger? My goal is to enable Apache to log large access_log entries (> 1024 chars) to a syslog-ng server. The vast majority of examples I've seen for connecting Apache to syslog-ng employ the ancient /usr/bin/logger -- but that approach chops up messages longer than 1024 chars. The alternative approach is to use a perl/python script, but I'm nervous about the overhead. Anyone know of an updated logger binary? Thanks for any pointers, -Brian
Hello, After changing the log_msg_size(65536); parameter in syslog-ng.conf's options {}; section, I've used logger to send a single message with a 64KB payload. Have you tried using logger yet to see if it does what you need? I've just tested this on ubuntu 8.04, the logger binary being part of the default installed bsdutils package 1:2.14.2-1ubuntu4. Keep in mind regular syslogd has a 1024KB limit and all messages passed through it first will get chopped. You can also do what Jim suggests and use a "file" sourcetype on your access_log and go from there. -Lance On Thu, Feb 4, 2010 at 5:00 PM, Brian Donaldson <briantd@gmail.com> wrote:
My goal is to enable Apache to log large access_log entries (> 1024 chars) to a syslog-ng server. The vast majority of examples I've seen for connecting Apache to syslog-ng employ the ancient /usr/bin/logger -- but that approach chops up messages longer than 1024 chars. The alternative approach is to use a perl/python script, but I'm nervous about the overhead. Anyone know of an updated logger binary?
Thanks for any pointers, -Brian
______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
Brian Donaldson wrote:
Anyone know of an updated logger binary?
logger is a very small program. -- You might try to increase its buffer size and recompile by yourself. -- Martin
I have replaced access_log with a pipe (using mkfifo), so that apache can write and syslog-ng can read it. I haven't tested it with big log entries though. Brian Donaldson wrote:
My goal is to enable Apache to log large access_log entries (> 1024 chars) to a syslog-ng server. The vast majority of examples I've seen for connecting Apache to syslog-ng employ the ancient /usr/bin/logger -- but that approach chops up messages longer than 1024 chars. The alternative approach is to use a perl/python script, but I'm nervous about the overhead. Anyone know of an updated logger binary?
Thanks for any pointers, -Brian
participants (5)
-
Brian Donaldson
-
Jim Hendrick
-
Lance Laursen
-
Martin Schütte
-
Sergei Zhirikov