On Mon, May 13, 2013 at 10:25:50AM -0600, Kevin Fenzi wrote:
On Mon, 13 May 2013 12:10:15 -0400 seth vidal skvidal@fedoraproject.org wrote:
The ways I know of to collect/store httpd logs are:
- rsyncing after the fact
- redir out to logger to dump to syslog
- other syslog-redirection trick
- direct-to-mysql log writes.
I'm sure there are lots of variations on 3 using non-syslog to replicate the logs.
the disadvantage of 1 is that we don't get the logs from 'just now' if something goes wrong. That's where we are now. The second issue is that we have to constantly update that list of hosts/files to replicate those logs.
Yeah.
the disad of 2 and 3 is that http logs can kick the crap out of syslog in short order. it may, however, be worth trying it with our system to see how much damage the httpd logs do.
the disad of 4 is the dep on a db server (and the disads from 1)
thoughts on trying to log http to rsyslog/log02?
well, we do have the fas servers sending error_log messages there, I'd really be worried that it wouldn't be able to keep up. Especially since some of our web apps are really really noisy. ;(
If you want to see if it breaks real quickly -- fas's access_log is probably the quickest growing log (although that may change once fas_openid is prevalent).
-Toshio