Hi all,
i set up an apache webserver wich logs with directives:
ErrorLog "|/usr/bin/logger -p local5.err -t error_www.mysite.com"
CustomLog "|/usr/bin/logger -p local6.info -t www.mysite.com " "combined"
then syslog forwards them with
local5.err @10.10.10.89
local6.info @10.10.10.89
and it works good!
now on 10.10.10.89 i set up an rsyslog server with directives
$template ApacheRemoteErr,%msg%"/var/log/rsyslog/Apache/%syslogtag%/Err.log"
local5.err -?ApacheRemoteErr
$template ApacheRemoteCustom,%msg%"/var/log/rsyslog/Apache/%syslogtag%/Custom.log"
local6.info -?ApacheRemoteCustom
the result is that i get these files in /var/log/rsyslog/Apache/
./www.mysite.com:/Custom.log
with customLog
./error_www.mysite.com:/Err.log
with ErroLog
./message/Err.log
with lines like
Mar 11 12:32:52 last message repeated 9 times
Mar 11 12:32:52 last message repeated 5 times
(Note that this is very annoying!!!)
Now this a simple way i have found to divide logs per VHost.
I don't know if there is a better way, but the real question is different:
In the Custom or Error logs i have lines like:
Mar 11 12:32:53 php03 www.mysite.com: 10.10.10.2 - -
[11/Mar/2008:12:35:07 +0100] "GET /pagina.php?id=61 HTTP/1.1" 200 93
"http://www.mysite.com/home.php" "Mozilla/5.0 (X11; U; Linux i686;
en-US; rv:1.7.13) Gecko/20060607"
i don't want the "Mar 11 12:32:53 php03 www.mysite.com:" part
do i have to use a double template setup? one for the file and one for
the content?
the template in the file seems to be this:
$template TraditionalFormat,%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"
but i need just
$template TheOneINeed,%msg%\n"
i want only the %msg%\n in my file
Thanks in advance
--
mr
i set up an apache webserver wich logs with directives:
ErrorLog "|/usr/bin/logger -p local5.err -t error_www.mysite.com"
CustomLog "|/usr/bin/logger -p local6.info -t www.mysite.com " "combined"
then syslog forwards them with
local5.err @10.10.10.89
local6.info @10.10.10.89
and it works good!
now on 10.10.10.89 i set up an rsyslog server with directives
$template ApacheRemoteErr,%msg%"/var/log/rsyslog/Apache/%syslogtag%/Err.log"
local5.err -?ApacheRemoteErr
$template ApacheRemoteCustom,%msg%"/var/log/rsyslog/Apache/%syslogtag%/Custom.log"
local6.info -?ApacheRemoteCustom
the result is that i get these files in /var/log/rsyslog/Apache/
./www.mysite.com:/Custom.log
with customLog
./error_www.mysite.com:/Err.log
with ErroLog
./message/Err.log
with lines like
Mar 11 12:32:52 last message repeated 9 times
Mar 11 12:32:52 last message repeated 5 times
(Note that this is very annoying!!!)
Now this a simple way i have found to divide logs per VHost.
I don't know if there is a better way, but the real question is different:
In the Custom or Error logs i have lines like:
Mar 11 12:32:53 php03 www.mysite.com: 10.10.10.2 - -
[11/Mar/2008:12:35:07 +0100] "GET /pagina.php?id=61 HTTP/1.1" 200 93
"http://www.mysite.com/home.php" "Mozilla/5.0 (X11; U; Linux i686;
en-US; rv:1.7.13) Gecko/20060607"
i don't want the "Mar 11 12:32:53 php03 www.mysite.com:" part
do i have to use a double template setup? one for the file and one for
the content?
the template in the file seems to be this:
$template TraditionalFormat,%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"
but i need just
$template TheOneINeed,%msg%\n"
i want only the %msg%\n in my file
Thanks in advance
--
mr