0

I'm setting up remote logging for the first time and am able to output all httpd messages to local6. I'm getting an error, and have a general question about rsyslog.

First:

I tried splitting error and access into seperate facilities with this configuration:

httpd.conf:

ErrorLog "| tee -a /var/log/httpd/error.log | logger -thttpd_servername_error -plocal6.err" CustomLog "|tee -a /var/log/httpd/access.log | logger -thttpd_servername_access -plocal8.notice" combined

rsyslog.conf:

# httpd messages
local6.*                                      /var/log/httpd_error.log
local8.*                                      /var/log/httpd_access.log

After restarting rsyslog I get this error:

Apr  7 13:36:44 boxname rsyslogd-3000: unknown facility name "local8" 

Second:

It seems counter-intuitive to have log data going to three places:

  • default httpd log in /var/log/httpd/error.log
  • rsyslog in /var/log/httpd_error.log
  • remote host (defined at bottom of rsyslog.conf)

I want local log files written and retained in addition to off-site logging, but I don't like the idea of having identical log data going in two local files.

Am I missing something important here? Is it possible to skip having rsyslog (redundantly) write to a local file and only send data remotely?

0

There's only facility levels local0-local7, no local8.

  • Yeah I figured out my mistake a few minutes ago. I have error and access going to separate facilities. I'm still unsure why I need to output to new files what is already being written to the existing apache logfiles (virtualhosts in play, and the apache log files are well organized). – a coder Apr 7 '15 at 18:35
  • @acoder: can you edit to include the forwarding part of your rsyslog.conf? To a zeroth approximation, I'd think simply not declaring a rule to send local6.* to a local file would solve your problem? – Ulrich Schwarz Apr 7 '15 at 18:37
  • Got it - I disabled the file streams and am just sending data via port 514 to external logger. Much better now. – a coder Apr 7 '15 at 18:38
  • Is it possible to further filter what is sent to the external server? Could I exclude notices from local5, for instance? – a coder Apr 7 '15 at 18:41
  • @acoder: I should think so, but I'm not sitting at a machine with rsyslog (and its manpages) isntalled right now. – Ulrich Schwarz Apr 7 '15 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.