I have a cluster of nginx web servers and a separate syslog server running rsyslog. The nginx vhost looks like this:

access_log      syslog:server=,facility=local1,severity=info combined;
error_log       syslog:server=,facility=local2 debug;

And the custom rsyslog config like this:

$template access_log,"/var/syslog/%HOSTNAME%/%PROGRAMNAME%/access.log"
$template error_log,"/var/syslog/%HOSTNAME%/%PROGRAMNAME%/error.log"
local1.*        -?access_log
local2.*        -?error_log

It works great but I would like to create separate log files on rsyslog for the different vhosts, so, e.g.,



And so on. How can I pass the host from nginx to rsyslog?


Not able to comment, but maybe this will get you started in the right direction.

Nginx allows you to set tags for each log. From the documentation for nginx syslog:


Sets the tag of syslog messages. Default is “nginx”.

For example I have this in my config:

access_log      syslog:server=server,tag=nginx_access;

For your site configuration you can set access and error logs per virtual server:

server {
    listen 80;
    server_name foo1.local;
    location /var/www/site1;
    access_log      syslog:server=server,tag=nginx_access_site1;

server {
    listen 80;
    server_name foo2.local;
    location /var/www/site2;
    access_log      syslog:server=server,tag=nginx_access_site2;

Now you should be able to filter these messages based on the tags. From How to filter rsyslog messages by tags you can set up a configuration file:

:syslogtag, isequal, "nginx_access_site1:" /var/syslog/my-hostname/nginx/site1-access.log
& stop

:syslogtag, isequal, "nginx_access_site2:" /var/syslog/my-hostname/nginx/site2-access.log
& stop

You also need to make sure that whatever you call this config file, it needs to get loaded before your default configs (which seems to be 50-default.conf) - so for example you could name it 20-nginx.conf.

  • Thanks, but this is not scalable as I would have to add a new tag filter to rsyslog for every vhost. I tried to use the tag for simply passing the host, but it only allows alphanumeric characters and underscore, thus some-example.com would not be allowed.
    – Cravid
    May 27 '16 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.