One of the projects I have for this year is the centralization of all Apache logs we have scattered across all our machines.
I know this kind of guide has been done before, but here’s my implementation for our systems.
- Install rsyslogd: apt-get install rsyslog. Some older machines we had were still using the older sysklogd, but form what I’ve gathered, it doesn’t support UDP transmission of the logs, so I didn’t fit me.
- Add the following rules to /etc/rsyslogd.conf:
local1.crit @destination-host
local1.info @destination-host - Restart rsyslogd: /etc/init.d/rsyslog restart
- Edit your apache settings to add the new log rules (normally /etc/apache2/sites-enabled/000-default):
ErrorLog syslog:local1
CustomLog “|/usr/bin/logger -p local1.info” combined - Restart apache: /etc/init.d/apache2 restart
- On the central machine add the following rules to syslog (this part is actually recycled from a Nuno Dantas implementation of the central logs for postfix):
source s_remote { udp(); };
destination d_clients { file(“/destination-path/$HOST”); };
log { source(s_remote); destination(d_clients); }; - Restart syslog. You should now have the apache logs coming…
After this, I implemented a AWStats central instance which parses all those nifty logs.
