Thats how I currently have it set: apache writes to a regular log file, sends a copy to rsyslog, rsyslog sends it to remote server.
How to set:
In vhosts directive:
Code:
CustomLog |/usr/bin/apache_syslog syslog
ErrorLog |/usr/bin/apache_syslog
/usr/bin/apache_syslog:
Code:
#!/usr/bin/perl
use Sys::Syslog qw( :DEFAULT setlogsock );
setlogsock('unix');
openlog('apache', 'cons,pid', 'local2');
while ($log = <STDIN>) {
syslog('notice', "HTTPD $log");
}
closelog;
Of course this requires syslog defined in apache, or use common/combined. Enjoy!