We want to use a central Logserver for our Webservers so we can manage everyhing on one machhine. I'm a bit scared of what happens if the network breaks or the Logserver is down.

Is it possible that if the client can't reach the logserver (TCP), that he will write it into local file?

Is it possible to make a failover like that?


rsyslog does this - if you tell it to transfer logs to a remote system, and that remote system cannot be reached, it caches them locally until the connection returns. Then it streams the logs out of the cached files, deleting the files afterward.

You will need to tell apache to log to syslog and then tell rsyslog to forward to your destination syslog server.

I had a working configuration at one point that served me well for a long time. At some point in the future if I dig through those old config files I may update this with an example.

If you have high security needs, you want to secure the connection between your webserver and syslog server with OpenVPN or other encryption.


Your webservers should already be writing to a local file, and syslog-ng is reading that file and sending it to your destination Logserver. On Ubuntu, Apache logs are saved by default in /var/log/apache2. Your syslog-ng.conf, or a file in the /etc/syslog-ng/conf.d directory should have lines like the following indicating where your Apache logs are being sent from.

source s_apache {

log { source(s_apache);

On re-reading the question, I noticed that you have not done this yet. I've actually written a blog post on step by step how to do this, which includes the above config, and leaves your data in the local logs as a failover.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.