I'm setting up central logging of Apache access logs using rsyslog on Ubuntu
x64 Server. The logging server (172.16.96.92) listens on a range of ports.
For the reporting servers I'd like a fallback local buffer, and no local
logging via rsyslog otherwise. Apache's logging on local0.info and all the
program names end with 'access.log', but can be quite long, hence the custom
template. Have I got the syntax correct? Is this the right place to put the
action queue lines?
$RepeatedMsgReduction off
$SystemLogRateLimitBurst 2000
# Apache
$template LongTagForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME%
%syslogtag%%msg:::sp-if-no-1st-sp%%msg%"
if syslogfacility-text == 'local0' and $programname contains 'access.log'
then {
$ActionQueueFileName queue
$ActionQueueMaxFileSize 1024m
$ActionQueueSaveOnShutdown on
$ActionQueueSize 1048576
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
local0.info @@172.16.96.92:10545;LongTagForwardFormat
& ~
}
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
