On Mon, 13 May 2013 12:10:15 -0400 seth vidal skvidal@fedoraproject.org wrote:
The ways I know of to collect/store httpd logs are:
- rsyncing after the fact
- redir out to logger to dump to syslog
- other syslog-redirection trick
- direct-to-mysql log writes.
I'm sure there are lots of variations on 3 using non-syslog to replicate the logs.
the disadvantage of 1 is that we don't get the logs from 'just now' if something goes wrong. That's where we are now. The second issue is that we have to constantly update that list of hosts/files to replicate those logs.
Yeah.
the disad of 2 and 3 is that http logs can kick the crap out of syslog in short order. it may, however, be worth trying it with our system to see how much damage the httpd logs do.
the disad of 4 is the dep on a db server (and the disads from 1)
thoughts on trying to log http to rsyslog/log02?
well, we do have the fas servers sending error_log messages there, I'd really be worried that it wouldn't be able to keep up. Especially since some of our web apps are really really noisy. ;(
I guess we could try adding them one by one and see when/if it breaks, but it might be better to revisit after we clean up apps logging some?
kevin