0

both apache access & apache error logs not arriving on central server. some logs are successfully arriving tho including: auth, authpriv, cron, daemon, kern, syslog logs. what else do i need to get apache logs centralized?

heres my testing lab setup -> server and clients are: Apache/2.4.41 running on Ubuntu Server 20.04 Linux 5.4.0-42. rsyslog server and clients are: 8.2001.0. only firewall is default iptables and ufw install.

server rsyslog config file is /etc/rsyslog.d/01-server.conf is:

$ModLoad imtcp
$InputTCPServerRun 514
$template RemoteServer, "/var/log/%HOSTNAME%/%SYSLOGFACILITY-TEXT%.log"
*.* ?RemoteServer
local3.*                        /local/logs/httpd-error
local4.*                        /local/logs/httpd-access

client rsyslog config file is /etc/rsyslog.d/01-client.conf is:

$WorkDirectory /var/log/rsyslogspools
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
local3.* @@192.168.1.88:514
local4.* @@192.168.1.88:514
*.*     @@192.168.1.88:514

client apache config file /etc/rsyslog.d/apache.conf is:

$ModLoad imfile
# Default Apache Error Log
$InputFileName /var/log/httpd/error_log
$InputFileTag httpd-error-default:
$InputFileStateFile stat-httpd-error
$InputFileSeverity info
$InputFileFacility local3
$InputRunFileMonitor
# Default Apache Access Log
$InputFileName /var/log/httpd/access_log
$InputFileTag httpd-access-default:
$InputFileStateFile stat-httpd-access
$InputFileSeverity info
$InputFileFacility local4
$InputRunFileMonitor
$InputFilePollInterval 10

this lab is running on virtualbox, rsyslog client server is working for most logs just not apache

1
  • I assume you have configured apache to use syslog for logging? (see mod_syslog)
    – Marco
    Aug 29, 2020 at 4:56

1 Answer 1

0

Your apache files monitoring should use the ubuntu/debian path instead of red-hat/centos (/var/log/httpd/error_log VS /var/log/apache2/error.log)

So change /etc/rsyslog.d/apache.conf to

$ModLoad imfile
# Default Apache Error Log
$InputFileName /var/log/apache2/error.log
$InputFileTag httpd-error-default:
$InputFileStateFile stat-httpd-error
$InputFileSeverity info
$InputFileFacility local3
$InputRunFileMonitor
# Default Apache Access Log
$InputFileName /var/log/apache2/access.log
$InputFileTag httpd-access-default:
$InputFileStateFile stat-httpd-access
$InputFileSeverity info
$InputFileFacility local4
$InputRunFileMonitor
$InputFilePollInterval 10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .