1

I want to send Apache HTTP Servercustom logs to a syslog server; built in is the functionality to this with the error logs but not custom logs. Can someone recommend a tool for this job, running on a Windows server?

1

I haven't tried it myself but you might want to have a look at this article: Sending Apache httpd Logs to Syslog:

Unfortunately, only the error log has this feature built in. It's extremely useful to also have your access logs logged to a remote server, for the reasons described earlier.

There is a technique to allow you to log your access log to syslog as well. However, as with any other article of this nature, I encourage you to check the Apache web server documentation site because this feature may be built-in at some point in the future, rendering this technique obsolete. At the moment, here's what you need to do. This is a two-step process.

First, create a script that is capable of sending entries to syslog:

#!/usr/bin/perl
use Sys::Syslog qw( :DEFAULT setlogsock );

setlogsock('unix');
openlog('apache', 'cons', 'pid', 'local2');

while ($log = <STDIN>) {
            syslog('notice', $log);
}
closelog This script, written in Perl, uses the [Sys::Syslog module][1] to send data to a syslog server. Make sure that you have the

Sys::Syslog module installed, but it should be standard on any fairly recent version of Perl.

Put this script somewhere and make it executable. For this example, I assume that you've put the script at /usr/local/apache/bin/apache_syslog.

Second, point your access log at this script using the piped logfile syntax:

CustomLog |/usr/local/apache/bin/apache_syslog combined

The apache_syslog script will launch when your web server starts up, and it processes logfile entries as it receives them from the server. The while loop will continue for the lifetime of the Apache server process.

As you can see in the script, it sends these entries to a syslog facility named local2, so configure your syslog server with an entry in /etc/syslog.conf like:

local2.*    @192.168.200.12

See the documentation for Sys::Syslog for more information on the options that are available to you in this module.

With this configuration, in the event that your server is compromised or there is catastrophic drive failure, you'll still have a remote copy of your logfiles to find out what happened.

Also note that if you have multiple CustomLog directives, you can have multiple logfiles. So, if you want to have a local logfile in addition to a remote one, just add an extra CustomLog directive pointing to a local logfile:

CustomLog /usr/local/apache/logs/access_log combined

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.