1

I'm setting up remote logging for the first time and am able to output all httpd messages to local6. I'm getting an error, and have a general question about rsyslog.

First:

I tried splitting error and access into seperate facilities with this configuration:

httpd.conf:

ErrorLog "| tee -a /var/log/httpd/error.log | logger -thttpd_servername_error -plocal6.err" CustomLog "|tee -a /var/log/httpd/access.log | logger -thttpd_servername_access -plocal8.notice" combined

rsyslog.conf:

# httpd messages
local6.*                                      /var/log/httpd_error.log
local8.*                                      /var/log/httpd_access.log

After restarting rsyslog I get this error: 

Apr  7 13:36:44 boxname rsyslogd-3000: unknown facility name "local8"

Second:

It seems counter-intuitive to have log data going to three places:

  • default httpd log in /var/log/httpd/error.log
  • rsyslog in /var/log/httpd_error.log
  • remote host (defined at bottom of rsyslog.conf)

I want local log files written and retained in addition to off-site logging, but I don't like the idea of having identical log data going in two local files.

Am I missing something important here? Is it possible to skip having rsyslog (redundantly) write to a local file and only send data remotely?

Improve this question

1 Answer 1

Reset to default
1

There's only facility levels local0-local7, no local8.

Improve this answer
6
  • Yeah I figured out my mistake a few minutes ago. I have error and access going to separate facilities. I'm still unsure why I need to output to new files what is already being written to the existing apache logfiles (virtualhosts in play, and the apache log files are well organized).
    – a coder
    Apr 7, 2015 at 18:35
  • @acoder: can you edit to include the forwarding part of your rsyslog.conf? To a zeroth approximation, I'd think simply not declaring a rule to send local6.* to a local file would solve your problem?
    – Ulrich Schwarz
    Apr 7, 2015 at 18:37
  • Got it - I disabled the file streams and am just sending data via port 514 to external logger. Much better now.
    – a coder
    Apr 7, 2015 at 18:38
  • Is it possible to further filter what is sent to the external server? Could I exclude notices from local5, for instance?
    – a coder
    Apr 7, 2015 at 18:41
  • @acoder: I should think so, but I'm not sitting at a machine with rsyslog (and its manpages) isntalled right now.
    – Ulrich Schwarz
    Apr 7, 2015 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .