Nginx adds logging to syslog feature in version 1.7.1.
I can only get the version 1.6.2 from
ppa:nginx/stable, or the version 1.4.6 from the default Ubuntu package sources.
I have a common log (rsyslog) server which collects data from a few dozen servers. rsyslog is already configured on every machine to propagate logs to either the primary log machine or the failover, if the primary is down.
What are my options for getting Nginx logs to local syslog (which then be sent to remote server by rsyslog)?
Note: while answers related directly to Nginx logging are welcome, I'm also looking for general answers which would apply to any application (thus the lack of nginx tag for this question). The reason is that I haven't migrated all the applications to
syslog yet, and I expect other apps to cause similar problems.
Important notes related to the accepted answer:
inotifyis available since the beta version of rsyslog 5.9.6, April 12th, 2012, it is otherwise supported only since January 24th, 2014 in rsyslog 8.1.5.
This requires using
ppa:adiscon/v8-stablein Ubuntu, since the latest Ubuntu distribution at the moment of writing (14.04 LTS) is using rsyslog 7.4.4.
inotifymode is specified in
PollingIntervaldoesn't have to be specified.
When the configuration is incorrect,
rsyslogdoesn't log anything to
/var/log/syslog. In order to inspect what's wrong, the command
rsyslogd -N1appears to be very helpful. Obviously,
ps -A | grep rsysloghelps too in order to find whether
rsyslogversion can be obtained by executing
input()should be set to zero.
input()configuration “should be placed on top of the rsyslog.conf file”.
It seems that
rsysloghates Nginx. It doesn't matter what owner, group or permissions are set on
/var/log/nginx/access.log, the file changes are ignored (without any error whatsoever). The same happens for any other file created in
When files are created in a different directory, such as
/var/log/, changes are reflected in