Remote logging of access log and syslog files

[Shivkumar]

Folks,

I am working on pros and cons of logging the Apache and iPlanet access log and syslog files to a remote HPUX box. I mean instead of writing access log file on local disk we want to write it on remote server's disks.

Can someone suggest the pros and cons of this and how this can be implemented ?

Also please let me know how to award the points to the folks who replies. I am new to this forum :-)

Thanks
Shiv

[Victor BERRIDGE · Accepted solution]

Hi,
Do a man logger...

Pros and cons:
Pros : you can centralize...
Cons : You will get messages of unknown server at the startup (because no network...but I may still have a misconfiguration somewhere...).

All the best
Victor

[Denver Osborn]

You should be able to configure Apache to pipe logs to an external program or send them to the localhosts syslog. Not sure how iPlanet works though.

Log directive might look something like this in your apache config

Customlog "| logger -t hostname_httpd -p local7.info" combined

Then you could configure your syslog to log to a remote host's syslog. (man syslogd for details)

# vi /etc/syslogd.conf
local7.info @remotehost
local7.info /var/adm/syslog/httpd.log

# kill -HUP

The above syslogd.conf entries should send all "local7.info" priority messages to the remote nodes syslog and a local log file.

*Keep in mind that any other apps that send messages to local7.info could be mixed in w/ your apache log entries.

It would be good to keep a copy of the access logs archived on a remote host so you have an audit trail in the event you're server get compromised.

Assigning points to ITRC threads is easy enough. Just be sure you're logged into the ITRC when you view your thread's responses. You should see a "pull down" for selecting point values, then I think you click something like "assign points"... you'll see.

Hope this gives you some ideas to build off of and test.

-denver

[Kent Ostby]

It depends on your mechanism for accessing those remote server disks.

If you're using NFS to access them then you create another point of failure by involving a NFS connection. If the remote machine needs a reboot, it could effect your setup.

Another option would be to log them locally and then write a script that will archive and ftp or email the old logs to a central machine.

The advantage to this approach is that if the archiving mechanism breaks, its unlikely to effect your ongoing production.

Best regards,

Kent M. Ostby