Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a couple Apache web servers that each have 4-8 separate virtual hosts on each of them. I'm trying to setup a dedicated log server that stores each virtual host access and errors logs in a separate directory for that virtual host.

For example on the logging server,
/var/log/remove/ contains access_log and error_log
/var/log/remove/ contains access_log and error_log /var/log/remove/ contains access_log and error_log
and so on...

Right now I have it split up by host but I can't figure out how to do it additionally by virtual host. Here are the relevant lines from the logging server's syslog-ng.conf

source r_src { tcp(ip("") port(5140)); };
destination r_all { file("/opt/splunk/logs/$HOST"); };
log { source(r_src); destination(r_all); };

Any help would be appreciated. Thanks!

share|improve this question

I think this should answer your question:

The summary: syslog-ng can extract fields from your log messages, and then you can use these fields in template substitutions. As long as your are logging the virtual host name (%v) in your Apache logs, you should have all the information you need.

share|improve this answer
Original poster seems to have vanished, but have an upvote as your answer has been useful for me. – Twirrim Feb 8 '11 at 20:40
I'm glad you've found it helpful! – larsks Feb 8 '11 at 20:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.