[SOLVED] syslog : access log of apache not working

nkd · 08-11-2011, 08:11 AM

hi all,
I am running a syslogd on my ubuntu 10.10 system.
I have a apache2 server on the same machine.

I have configured my apache2.conf file to send the error logs to the local syslog server. The config is as under :-

Quote:

LogLevel notice
ErrorLog syslog:local1

I have also configured the /etc/syslog.conf as under :-

Quote:

local1.info /var/log/apache2/error_logs

I have created a file in the /var/log/apache2 dir with the ownerships and permissions as under :-

Quote:

-rwxrwxrwx 1 syslog adm 77 2011-08-11 18:14 /var/log/apache2/error_logs

Next I restarted the sysklogd and apache2 servers with a service command as under :-

Quote:

sudo service sysklogd restart
sudo service apache2 restart

I thereafter observed the /var/log/apache2/error_logs file and found the entries for apache2 closing down and coming up as under :-

Quote:

Aug 11 18:14:14 cc apache2[4940]: [notice] caught SIGTERM, shutting down
Aug 11 18:14:19 cc apache2[5282]: [notice] ModSecurity for Apache/2.5.12 (http://www.modsecurity.org/) configured.
Aug 11 18:14:19 cc apache2[5282]: [notice] Original server signature: Apache/2.2.16 (Ubuntu) mod_ssl/2.2.16 OpenSSL/0.9.8o
Aug 11 18:14:20 cc apache2[5285]: [notice] Apache/2.2.16 (Ubuntu) mod_ssl/2.2.16 OpenSSL/0.9.8o Microsoft-IIS/5.0 configured -- resuming normal operations

Now the problem is I donot get any other messages thereafter. so it is hardly useful. How can I increase the logged messages from apache. I tried the facility

Quote:

local1.*

Then restarted the sysklogd and apache2 , but the contents of the /var/log/error_logs file remained similar.

Next , I followed the link.
I created the perl script for recording access logs of apache2. I then restarted the apache2 and sysklogd. when I opened my website from a browser, the access log did not work. Question is why ?

I think I am getting something wrong with the facility value , in apache2.conf it is ErrorLog syslog:local1 ! but the script is suggesting that it should be local2 in the line 4

Quote:

openlog('apache','cons','pid','local2');

I therefore changed the script to local1 in above line. But still no access log !?!?

Can someone help me out.
thanks in advance
bye
nishith

bathory · 08-11-2011, 12:57 PM

Quote:

I have created a file in the /var/log/apache2 dir with the ownerships and permissions as under :-
-rwxrwxrwx 1 syslog adm 77 2011-08-11 18:14 /var/log/apache2/error_logs

You don't. The logfile will be created by restarting syslogd

Quote:

Now the problem is I donot get any other messages thereafter. so it is hardly useful. How can I increase the logged messages from apache. I tried the facility
Quote:
local1.*
Then restarted the sysklogd and apache2 , but the contents of the /var/log/error_logs file remained similar.

Use:

Code:

local1.* /var/log/apache2/error_logs

Mind that you need to check any vhost you may have and change the ErrorLog there too. After restarting the 2 daemons, try to access a non existent page and see if it's logged by syslog.

Quote:

Next , I followed the link.
I created the perl script for recording access logs of apache2.
<snip>
I therefore changed the script to local1 in above line. But still no access log !?!?

Dunno, but you may use the logger binary:

Code:

CustomLog "|/usr/bin/logger -p local2.info" combined

and of course add in /etc/syslog.conf:

Code:

local2.*  /var/log/apache2/access.log

Regards

nkd · 08-11-2011, 01:15 PM

thanks bathory for your response.
I figured out the solutions as under :-
1. To get the error logs other than only the stop and starting messages from apache, change in /etc/apache2/apache2.conf file the directive LogLevel as under :-

Quote:

LogLevel info

This will ensure apache will send all messages above info severity level to syslog. Setting the

Quote:

local1.* /var/log/apache2/error_logs

in /etc/syslog.conf only tells syslog to catch all messages from the facility local1.
The problem in my case was LogLevel in apache2.conf file was set to notice. Therefore, nothing below that severity was being sent by apache to Syslog - and the messages were not just showing up in the /var/log/apache2/error_logs file.

2. The CustomLog entry was not working because, I was ignorant that the VirtualHost container in the /etc/apache2/site-enabled/default file had it's own CustomLog directive :-

Quote:

CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

which was overriding the directive set in the /etc/apache2/apache2.conf file.
So I just commented the CustomLog entry in the VirtualHost container.

A lot of thanks for your valuable help and suggestions
regards
nishith

sanonyme · 05-08-2016, 01:48 PM

please tell me where you have put this sentence : CustomLog |/usr/local/bin/apache_rsyslog combined !!! I'm blocked i dont' know where im supposed to put it