2008/3/11, Rainer Gerhards <[EMAIL PROTECTED]>: > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of > > Maurizio Rottin > > Sent: Tuesday, March 11, 2008 1:02 PM > > To: [email protected] > > Subject: [rsyslog] rsyslog with apache and per vhost log > > > > Hi all, > > i set up an apache webserver wich logs with directives: > > ErrorLog "|/usr/bin/logger -p local5.err -t error_www.mysite.com" > > CustomLog "|/usr/bin/logger -p local6.info -t www.mysite.com > > " "combined" > > > > then syslog forwards them with > > local5.err @10.10.10.89 > > local6.info @10.10.10.89 > > and it works good! > > > > now on 10.10.10.89 i set up an rsyslog server with directives > > $template > > ApacheRemoteErr,%msg%"/var/log/rsyslog/Apache/%syslogtag%/Err.log" > > local5.err -?ApacheRemoteErr > > $template > > ApacheRemoteCustom,%msg%"/var/log/rsyslog/Apache/%syslogtag%/C > > ustom.log" > > local6.info -?ApacheRemoteCustom > > > > the result is that i get these files in /var/log/rsyslog/Apache/ > > ./www.mysite.com:/Custom.log > > with customLog > > > > ./error_www.mysite.com:/Err.log > > with ErroLog > > > > ./message/Err.log > > with lines like > > Mar 11 12:32:52 last message repeated 9 times > > Mar 11 12:32:52 last message repeated 5 times > > (Note that this is very annoying!!!) > > > Add -e to rsyslogd startup and they go away ;) (this is part of sysklogd > compatibility, -e stand for "log *e*very message")
And i red about the -e options a lot of times...thank! > > > > > > > Now this a simple way i have found to divide logs per VHost. > > I don't know if there is a better way, but the real question > > is different: > > In the Custom or Error logs i have lines like: > > Mar 11 12:32:53 php03 www.mysite.com: 10.10.10.2 - - > > [11/Mar/2008:12:35:07 +0100] "GET /pagina.php?id=61 HTTP/1.1" 200 93 > > "http://www.mysite.com/home.php"; "Mozilla/5.0 (X11; U; Linux i686; > > en-US; rv:1.7.13) Gecko/20060607" > > > > i don't want the "Mar 11 12:32:53 php03 www.mysite.com:" part > > do i have to use a double template setup? one for the file and one for > > the content? > > > > This is caused by the default template, which is what most peiople > expect in their syslog files. But, as you write, the soluton is quite > easy, just use another template ;) > > > > the template in the file seems to be this: > > $template TraditionalFormat,%timegenerated% %HOSTNAME% > > %syslogtag%%msg%\n" > > but i need just > > $template TheOneINeed,%msg%\n" > > i want only the %msg%\n in my file > > > > > So, use > > local6.info -?ApacheRemoteCustom;TheOneINeed works great man! Thanks! > HTH, feel free to ask any follow-up questions. :) > just one question, do you know any way to pass the website name in "/usr/bin/logger -p local5.err -t error_www.mysite.com", even using an other program...i know only logger... -- mr _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
