[syslog-ng] Apache Syslog-ng/Syslog-ng newbie

[Brian Bemis]

I think you understood me correctly. The local syslogd could actually be
syslog-ng if you want, it doesn't really matter (I use syslog-ng on both
ends). It's not too hard to implement (I did have to modify the source code
of Snare in order to get AWStats to interpret the log files), but besides
that it was pretty easy. As far as the load goes, I'm not really sure since
right now the only 2 servers I'm using it on are not high load servers. I
hope that helps.

 

Brian

 

  _____  

From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Esquivel, Vicente
Sent: Monday, November 21, 2005 3:50 PM
To: Syslog-ng users' and developers' mailing list
Subject: RE: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie

 

Thanks for responding.

 

So let me make sure I am understanding what you suggested.

 

You said that I could run SnareApache on the servers running apache, then
let Snare send the Apache access logs to the local syslog on that same
server then have the syslogd on that server send them to  the centralized
syslog server that is logging via syslog-ng?

 

So I take it that Apache can't do it any other way without something like
Snare?

 

How much of a load does it add to a server and how difficult is it to
implement?

 

Thanks!

Vince

 

 


  _____  


From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Brian Bemis
Sent: Monday, November 21, 2005 2:39 PM
To: 'Syslog-ng users' and developers' mailing list'
Subject: RE: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie

For the error logs, logging to syslog (or syslog-ng) is built into Apache.

For the access logs, try SNARE for Apache:

http://www.intersectalliance.com/projects/SnareApache/index.html

You can use this in conjunction with syslog-ng. It will send you're apache
logs to the syslog daemon on the local system, then all you have to do it
set up syslog-ng to forward the logs to a central server and separate them
according to the server sending the logs. This is all built into syslog-ng. 

 

b

 

 


  _____  


From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Esquivel, Vicente
Sent: Monday, November 21, 2005 8:39 AM
To: Syslog-ng users' and developers' mailing list
Subject: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie

 

Hello all,

 

I am new to this list, I am seeking some help on how to setup syslog-ng as a
central log server.  More importantly I am wanting to know how to log all of
my Apache servers to the central log server, but also create separate logs
for each of the systems.  For example I am looking to do something like
this:

 

Apache1

/var/log/Apache1/httpd/access.log

/var/log/Apache1/httpd/error.log

 

Apache2

/var/log/Apache2/httpd/access.log

/var/log/Apache2/httpd/error.log

 

Apache3

/var/log/Apache3/httpd/access.log

/var/log/Apache3/httd/error.log

 

and so on.

 

Thanks all in advance

 

Vince

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20051122/992701e1/attachment.html