Hi all, i set up an apache webserver wich logs with directives: ErrorLog "|/usr/bin/logger -p local5.err -t error_www.mysite.com" CustomLog "|/usr/bin/logger -p local6.info -t www.mysite.com " "combined"
then syslog forwards them with local5.err @10.10.10.89 local6.info @10.10.10.89 and it works good! now on 10.10.10.89 i set up an rsyslog server with directives $template ApacheRemoteErr,%msg%"/var/log/rsyslog/Apache/%syslogtag%/Err.log" local5.err -?ApacheRemoteErr $template ApacheRemoteCustom,%msg%"/var/log/rsyslog/Apache/%syslogtag%/Custom.log" local6.info -?ApacheRemoteCustom the result is that i get these files in /var/log/rsyslog/Apache/ ./www.mysite.com:/Custom.log with customLog ./error_www.mysite.com:/Err.log with ErroLog ./message/Err.log with lines like Mar 11 12:32:52 last message repeated 9 times Mar 11 12:32:52 last message repeated 5 times (Note that this is very annoying!!!) Now this a simple way i have found to divide logs per VHost. I don't know if there is a better way, but the real question is different: In the Custom or Error logs i have lines like: Mar 11 12:32:53 php03 www.mysite.com: 10.10.10.2 - - [11/Mar/2008:12:35:07 +0100] "GET /pagina.php?id=61 HTTP/1.1" 200 93 "http://www.mysite.com/home.php"; "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko/20060607" i don't want the "Mar 11 12:32:53 php03 www.mysite.com:" part do i have to use a double template setup? one for the file and one for the content? the template in the file seems to be this: $template TraditionalFormat,%timegenerated% %HOSTNAME% %syslogtag%%msg%\n" but i need just $template TheOneINeed,%msg%\n" i want only the %msg%\n in my file Thanks in advance -- mr _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
