[syslog-ng]apache logs

[Santiago =?ISO-8859-1?Q?G=03=F3mez?= Cano]

El 21 Feb 2001 09:41:50 +0000, laurence@uwc.ac.za escribió:

> 
> Hi I was wondering if anyone has any creative ways to get my apache logs 
> into syslog-ng?
> 
> Laurence
> 
> 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng



You can configure apache to send the logs to a custom program or script that handles
the logs and sends it to syslog-ng using the facility and priority you want. I have setted up
my httpd.conf to send the logs to a couple of perl scripts using a pype as shown:

   ErrorLog "| /usr/local/bin/apache-error-logger www1.tiscali.es"
   TransferLog "| /usr/local/bin/apache-transfer-logger www1.tiscali.es"


This is the perl script I use to sed the logs to syslog-ng. I use local0 facility for
error logs and local1 for transfer logs and info priority. This is a good way to filter
the log lines when arriving syslog-ng. Here is the script that handles the access logs.
It's a perl script, but you can use the logger command to do it with a shell script if
you don't feel comfortable with perl :-)

#!/usr/local/bin/perl
# script: apache-access-logger

use Sys::Syslog;
$SERVER_NAME = shift || 'www';

$PRIORITY = 'info';
$FACILITY = 'local1';

Sys::Syslog::setlogsock('unix');
openlog ($SERVER_NAME,'ndelay', $FACILITY);
while (<>) {
  chomp;
  syslog($PRIORITY,$_);
}
closelog;

The only problem I have seen is that syslog-ng will not write the logs received
from apache using the apache log format because it adds some additional info
at the beggining of each line. You must know it if you intend to get statistics
from your apache log files. From syslog-ng 1.5.3 you can define the log file
format and it may be a help in this case, but I have not tested it yet.

Regards,

Santi

-- 
Santiago Gómez Cano
Administrador de Sistemas
santiago.gomez@tiscali.es
Tiscali Telecomunicaciones, S.A.
www.tiscali.es
T. +34 918370546 
T. +34 699459573