[syslog-ng] Apache vhost logs

[Josu Lazkano]

Thanks again, I need to change a little changes.

I configure this way:

filter f_local5 {
        facility(local5);
};

destination d_apache {
        file("/var/log/apache.log");
};

log {
        source(s_all);
        filter(f_local5);
        destination(d_apache);
};

But I want to save the apache logs on a directory inside each host:

destination extern {
        file("/var/log/extern/${HOST}/${YEAR}-${MONTH}/${FACILITY}");
};


I wan tto change the name "local5" to "apache"

$ tree /var/log/extern/host1/
/var/log/extern/fbmwebs01/
âââ 2011-07
    âââ auth
    âââ authpriv
    âââ cron
    âââ daemon
    âââ kern
    âââ local5    <-- I want to change this
    âââ syslog
    âââ user

This is all the configuration on the server side:

options {
        log_fifo_size(2048);
        create_dirs(yes);
        group(adm);
        perm(0640);
        dir_perm(0755);
        use_dns(yes);
        stats_freq(0);
        bad_hostname("^gconfd$");
};



source s_all {
        internal();
        unix-stream("/dev/log");
        file("/proc/kmsg" log_prefix("kernel: "));
        tcp();
};

destination extern {
        file("/var/log/extern/${HOST}/${YEAR}-${MONTH}/${FACILITY}");
};

log {
        source(s_all);
        destination(extern);
};

filter f_local5 {
        facility(local5);
};

destination d_apache {
        file("/var/log/extern/apache.log");
};

log {
        source(s_all);
        filter(f_local5);
        destination(d_apache);
};

Thanks for your great help, best regards.

-----Mensaje original-----
De: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] En nombre de Gergely Nagy
Enviado el: jueves, 14 de julio de 2011 11:40
Para: Syslog-ng users' and developers' mailing list
Asunto: Re: [syslog-ng] Apache vhost logs

Josu Lazkano <josu.lazkano at barcelonamedia.org> writes:

> Thanks!!!
>
> This work for me, las question.
>
> Is possible to add a facility name on apache to archive on the logserver as "apache" file?

Facilities are transmitted as numbers over the wire. Using the CustomLog
suggested by Matias, you could do something like this on server side:

filter f_local5 { facility(local5); };
destination d_apache { file("/var/log/apache.log"); };
log { source(s_all); filter(f_local5); destination(d_apache); };

(Not tested, but should work nevertheless)

-- 
|8]

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq