I'm setting up remote logging for the first time and am able to output all httpd messages to local6. I'm getting an error, and have a general question about rsyslog.
I tried splitting error and access into seperate facilities with this configuration:
ErrorLog "| tee -a /var/log/httpd/error.log | logger -thttpd_servername_error -plocal6.err" CustomLog "|tee -a /var/log/httpd/access.log | logger -thttpd_servername_access -plocal8.notice" combined
# httpd messages local6.* /var/log/httpd_error.log local8.* /var/log/httpd_access.log
After restarting rsyslog I get this error:
Apr 7 13:36:44 boxname rsyslogd-3000: unknown facility name "local8"
It seems counter-intuitive to have log data going to three places:
- default httpd log in /var/log/httpd/error.log
- rsyslog in /var/log/httpd_error.log
- remote host (defined at bottom of rsyslog.conf)
I want local log files written and retained in addition to off-site logging, but I don't like the idea of having identical log data going in two local files.
Am I missing something important here? Is it possible to skip having rsyslog (redundantly) write to a local file and only send data remotely?