> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Maurizio Rottin > Sent: Tuesday, March 11, 2008 1:02 PM > To: [email protected] > Subject: [rsyslog] rsyslog with apache and per vhost log > > Hi all, > i set up an apache webserver wich logs with directives: > ErrorLog "|/usr/bin/logger -p local5.err -t error_www.mysite.com" > CustomLog "|/usr/bin/logger -p local6.info -t www.mysite.com > " "combined" > > then syslog forwards them with > local5.err @10.10.10.89 > local6.info @10.10.10.89 > and it works good! > > now on 10.10.10.89 i set up an rsyslog server with directives > $template > ApacheRemoteErr,%msg%"/var/log/rsyslog/Apache/%syslogtag%/Err.log" > local5.err -?ApacheRemoteErr > $template > ApacheRemoteCustom,%msg%"/var/log/rsyslog/Apache/%syslogtag%/C > ustom.log" > local6.info -?ApacheRemoteCustom > > the result is that i get these files in /var/log/rsyslog/Apache/ > ./www.mysite.com:/Custom.log > with customLog > > ./error_www.mysite.com:/Err.log > with ErroLog > > ./message/Err.log > with lines like > Mar 11 12:32:52 last message repeated 9 times > Mar 11 12:32:52 last message repeated 5 times > (Note that this is very annoying!!!)
Add -e to rsyslogd startup and they go away ;) (this is part of sysklogd compatibility, -e stand for "log *e*very message") > > > Now this a simple way i have found to divide logs per VHost. > I don't know if there is a better way, but the real question > is different: > In the Custom or Error logs i have lines like: > Mar 11 12:32:53 php03 www.mysite.com: 10.10.10.2 - - > [11/Mar/2008:12:35:07 +0100] "GET /pagina.php?id=61 HTTP/1.1" 200 93 > "http://www.mysite.com/home.php"; "Mozilla/5.0 (X11; U; Linux i686; > en-US; rv:1.7.13) Gecko/20060607" > > i don't want the "Mar 11 12:32:53 php03 www.mysite.com:" part > do i have to use a double template setup? one for the file and one for > the content? > This is caused by the default template, which is what most peiople expect in their syslog files. But, as you write, the soluton is quite easy, just use another template ;) > the template in the file seems to be this: > $template TraditionalFormat,%timegenerated% %HOSTNAME% > %syslogtag%%msg%\n" > but i need just > $template TheOneINeed,%msg%\n" > i want only the %msg%\n in my file > So, use local6.info -?ApacheRemoteCustom;TheOneINeed HTH, feel free to ask any follow-up questions. :) Rainer > > Thanks in advance > > -- > mr > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
