Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a couple Apache web servers that each have 4-8 separate virtual hosts on each of them. I'm trying to setup a dedicated log server that stores each virtual host access and errors logs in a separate directory for that virtual host.

For example on the logging server,
/var/log/remove/10.0.0.2/virtualhost1 contains access_log and error_log
/var/log/remove/10.0.0.2/virtualhost2 contains access_log and error_log /var/log/remove/10.0.0.3/virtualhost3 contains access_log and error_log
and so on...

Right now I have it split up by host but I can't figure out how to do it additionally by virtual host. Here are the relevant lines from the logging server's syslog-ng.conf

source r_src { tcp(ip("0.0.0.0") port(5140)); };
destination r_all { file("/opt/splunk/logs/$HOST"); };
log { source(r_src); destination(r_all); };

Any help would be appreciated. Thanks!

share|improve this question

1 Answer 1

I think this should answer your question:

The summary: syslog-ng can extract fields from your log messages, and then you can use these fields in template substitutions. As long as your are logging the virtual host name (%v) in your Apache logs, you should have all the information you need.

share|improve this answer
    
Original poster seems to have vanished, but have an upvote as your answer has been useful for me. –  Twirrim Feb 8 '11 at 20:40
    
I'm glad you've found it helpful! –  larsks Feb 8 '11 at 20:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.