Apache log to syslog

Submitted by g.carabetta on Wed, 11/25/2015 - 10:02 Pro Licensee

I read some documentation to forward apache's logs to a remote syslog server, and also on how keep also the usual locale log files.

The question is: there is a webmin module to do that system-wide? So I can set it as default policy insted of hand modify the httpd.conf file.

Also, an "official-supported-certified way" is better to keep all things working correctly system-wide (log analisys as first, and so on).

Can you help me?

Thanks

Status: 
Active

Comments

Submitted by andreychek on Wed, 11/25/2015 - 10:13

Howdy -- that would likely require a few changes to config files, both on your existing server, as well as the remote syslog server.

However, if you need to make changes to the Apache config for the individual domains you have, that can be done using System Settings -> Server Templates -> Default -> Apache Website, and there you can change the parameters used for new sites.

If you have additional questions -- as it looks like you're using Virtualmin GPL there, could you start a new thread in the Forums, and there, let us know exactly what changes you need to make to make your setup work.

Then, we can go over the best way to implement those changes.

Submitted by g.carabetta on Thu, 11/26/2015 - 08:27 Pro Licensee

Oh! I'm sorry, I've missed the license info:

SerialNumber=5558824 LicenseKey=DLPDSGKADD (I'm also going to renew it for the 2016)

So, now I need to define a set of instructions to add to the existing httpd.conf, and also add the same set to the default template for future new domains, correct?

May be in a far future will be a webmine module to assist in this needs? :)

Thanks

Submitted by andreychek on Sat, 11/28/2015 - 10:26

Ah, sorry for the confusion... it looks like your license is associated with a different username, but that's no problem at all.

Regarding the changes you're looking to make -- what is it that you need to add into the Apache config to make it work properly for your remote syslog setup?

Submitted by g.carabetta on Mon, 11/30/2015 - 08:34 Pro Licensee

I'm trying to think about what to get and how.

On the one hand, I have to redirect logs to a centralized server, on the other hand I have to keep local logs as they are, not to disrupt other functions connected (such as statistical analysis of accesses, and others that I don't know...).

I found a couple of statements that should do the trick:

From ErrorLog logs/error_log CustomLog logs/access_log combined To ErrorLog syslog:local6 CustomLog "||/bin/logger -t httpd -p local6.info" combined

The double pipe seems to be an optimization.

But doing so I'll lose the information "who owns the logs" before this was represented by the file name.

So I changed also:

From LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined to LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedPlus

to include in the same line of the log which virtualhost was called.

So we will have for each virtualhost the following definition:

CustomLog /var/log/virtualmin/DOMAIN_access_log combined CustomLog "||/bin/logger -t httpd -p local6.info" combinedPlus

The problem remains with the file error: there can not define the format of the log. So I thought to act via the logger:

ErrorLog /var/log/virtualmin/DOMAIN_error_log ErrorLog "||/bin/logger -t httpd_DOMAIN_error -p local6.err"

I'm going to do some test with it: what do you think about it?

PS: about licenses. I think you have my license associated with the name "Thaos" it's my "seller", where I bought licenses, installations and some assistance. But this time I preferred to work by myself on this question ;)

Submitted by andreychek on Mon, 11/30/2015 - 10:08

Yeah, seeing what you're looking to do -- that should all work fairly well for new domains, by adding that into the Apache Website section of the Server Templates.

Once you do that -- or any new domain you add, those new lines you're using would be added into the Apache config.

That shouldn't be a problem at all... though if you run into problems let us know.

We haven't received many requests to add automatic setup of remote syslog logging into websites setup by Virtualmin. I unfortunately suspect that won't be an official feature that's added.

However, I'll review that a bit, maybe there's a case for being able to do that within Cloudmin.