Hi, > We are currently running a small rsyslog setup (i.e. TCP-based remote > logging) in our test environment. > > This setup is also used to transfer Apache access logs, using the pipe > operator in the Apache config and a Bash shell script which calls the > "logger" tool to log a message to local rsyslog in a loop like > > # read first line > #... > > while [ $result -eq 0 ]; do > # log $line to $filename > logger -p local0.info -t "APACHE" "$filename?$line" > read line > result=$? > done
Why not use the CustomLog Apache directive to pipe directly the logger command: ... LogFormat "%b%l%a%h %b%l%a%h ..." logger_pipe CustomLog |/usr/bin/logger -p local0.info -t "apache" logger_pipe It should spawn only one logger process for the whole Apache host, and most likely reduce the load. > Secondly, in order to resolve the first issue, we thought about moving to > the file based input module which would make (we hope) Apache performance > less depending on the logging infrastructure - as it would just log to the > native filesystem as usual. However, as can be seen above, we're currently > transforming the log messages to include the destination filename. > On the remote rsyslog server (the receiving end), the messages are logged > into a file whose name is dynamically derived from the first part of the > log (the part before the first question mark). Again, you can use the LogFormat for that, and let Apache do the work without spawning processes over and over, which is most likely the slow part. > > So my question is: can rsyslog be configured to > 1. Read new lines from Apache access log as they become available > 2. prepend an arbitrary string to the message (the destination > filename) In principle, you should use a template for that (untested): $template TemplateName,"CONSTANT_ARBITRARY_STRING?%message%" if ($programname = "apache") then destination;TemplateName (Although I cannot assure how it behaves with TCP...) Cheers. -- Luis Fernando Muñoz Mejías [email protected] _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
