From lms at fe.up.pt  Wed Oct 15 15:11:13 2008
From: lms at fe.up.pt (Luis Miguel Silva)
Date: Wed, 15 Oct 2008 20:11:13 +0100
Subject: [gltail] GLTail and syslog or syslog-ng
Message-ID: <48F64051.50702@fe.up.pt>

Hello everyone,

I have a centralized syslog-ng server which currently stores all the
syslog log files (doh :oP).

It would be great if i could feed those logs directly into gltail. Is
there any way?

Basically, i'm currently saving all the logs to different directories
depending on the date and server.
I can forward all of them to the same location BUT...what about the parsers?

Is there any parser that can understand apache syslogged messages?

Here is how i'm logging apache to syslog:
knox:/etc/apache2/sites-available# cat /usr/local/bin/apache_syslog
#!/usr/bin/perl
use Sys::Syslog qw( :DEFAULT setlogsock );
setlogsock('unix');
openlog('apache', 'cons', 'pid', 'local2');
while ($log = <STDIN>) {
            syslog('notice', $log);
}
closelog
knox:/etc/apache2/sites-available#
knox:/etc/apache2/sites-available# tail default
        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel notice

        CustomLog /var/log/apache2/access.log combined
        CustomLog "|/usr/local/bin/apache_syslog" combined              
<---- here it is! :oP
        ServerSignature Off
        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl/apache.pem
</VirtualHost>

Any thoughts?

Thanks,
-- 
Lu?s Silva
 
Qualidade e Seguran?a
Centro de Inform?tica Prof. Correia de Ara?jo (CICA)
Faculdade de Engenharia da Universidade do Porto (FEUP)
 
Tlf: (+351) 225 574 199 (3018) - SIP/VoIP: lms at fe.up.pt / Ext: 3018

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/gltail-general/attachments/20081015/01ea3282/attachment.html>

From mr at fudgie.org  Thu Oct 16 09:35:04 2008
From: mr at fudgie.org (Erlend Simonsen)
Date: Thu, 16 Oct 2008 15:35:04 +0200
Subject: [gltail] GLTail and syslog or syslog-ng
In-Reply-To: <48F64051.50702@fe.up.pt>
References: <48F64051.50702@fe.up.pt>
Message-ID: <e205fc9f0810160635k11e8e50ex44d4c7369ba18c5e@mail.gmail.com>

I don't think there's an Apache Syslog parser, but it's not hard to modify
the current Apache log parser to support it.

-- Erlend

On Wed, Oct 15, 2008 at 9:11 PM, Luis Miguel Silva <lms at fe.up.pt> wrote:

>  Hello everyone,
>
> I have a centralized syslog-ng server which currently stores all the syslog
> log files (doh :oP).
>
> It would be great if i could feed those logs directly into gltail. Is there
> any way?
>
> Basically, i'm currently saving all the logs to different directories
> depending on the date and server.
> I can forward all of them to the same location BUT...what about the
> parsers?
>
> Is there any parser that can understand apache syslogged messages?
>
> Here is how i'm logging apache to syslog:
> knox:/etc/apache2/sites-available# cat /usr/local/bin/apache_syslog
> #!/usr/bin/perl
> use Sys::Syslog qw( :DEFAULT setlogsock );
> setlogsock('unix');
> openlog('apache', 'cons', 'pid', 'local2');
> while ($log = <STDIN>) {
>             syslog('notice', $log);
> }
> closelog
> knox:/etc/apache2/sites-available#
> knox:/etc/apache2/sites-available# tail default
>         # Possible values include: debug, info, notice, warn, error, crit,
>         # alert, emerg.
>         LogLevel notice
>
>         CustomLog /var/log/apache2/access.log combined
>         CustomLog "|/usr/local/bin/apache_syslog" combined
> <---- here it is! :oP
>         ServerSignature Off
>         SSLEngine on
>         SSLCertificateFile /etc/apache2/ssl/apache.pem
> </VirtualHost>
>
> Any thoughts?
>
> Thanks,
> --
> Lu?s Silva
>
> Qualidade e Seguran?a
> Centro de Inform?tica Prof. Correia de Ara?jo (CICA)
> Faculdade de Engenharia da Universidade do Porto (FEUP)
>
> Tlf: (+351) 225 574 199 (3018) - SIP/VoIP: lms at fe.up.pt / Ext: 3018
>
>
> _______________________________________________
> gltail-general mailing list
> gltail-general at rubyforge.org
> http://rubyforge.org/mailman/listinfo/gltail-general
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/gltail-general/attachments/20081016/48bee5b1/attachment-0001.html>