2

I wnat to send nginx access log to a remote syslog-ng server. I installed syslog-ng on each side (server-client).

Client: 10.10.10.2
Server: 10.10.10.1

Some log files (messages,syslog,mail.log) are successfully sent to the server from the client, but not the nginx log. Server config:

source s_net {
   tcp(ip(0.0.0.0) port(1999)
   tls( key_file("/etc/syslog-ng/key.d/privkey.pem")
        cert_file("/etc/syslog-ng/cert.d/cacert.pem")
        peer_verify(optional-untrusted)) ); };

destination d_net_nginx_access { file("/mnt/syslog_storage/HOSTS/$HOST
/nginx.access.log"); };

filter f_nginx_access { program("nginx") };

log { source(s_net); filter(f_nginx_access); destination(d_net_nginx_access); };

Client config:

source s_src {
       system();
       internal();
};

destination tls_log {
tcp("10.10.10.1" port(1999)
tls( ca_dir("/etc/syslog-ng/ca.d")) );};

destination d_nginx_access { file("/var/log/nginx/nginx.access.log"); };

filter f_nginx { program("nginx"); };

log { source(s_src); filter(f_nginx); destination(d_nginx_access); };

# All messages send to a remote site
#
log { source(s_src); destination(tls_log); };

What am I missing here?

  • There is a nice reply on the same issue here that should help you out. – cherrysoft Sep 19 '14 at 10:27
2

That functionality was once reserved to the commercial variant of nginx, but has since been included in the OS version. You can use the nginx module ngx_http_log_module for that.

Here's a link to the module documentation, explaining the setup and configuration:
http://nginx.org/en/docs/http/ngx_http_log_module.html

Usage

Syntax:
access_log path [format [buffer=size [flush=time]] [if=condition]];
access_log path format gzip[=level] [buffer=size] [flush=time] [if=condition];
access_log syslog:server=address[,parameter=value] [format [if=condition]];
access_log off;

Default:    
access_log logs/access.log combined;
Context:    http, server, location, if in location, limit_except

The 3rd form is the one you want to use:

access_log syslog:server=address[,parameter=value] [format [if=condition]];

Include the IP address of the remote server where Syslog is running.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.