我一直试图通过系统日志路由Apache的日志(由于某种原因,日志轮换已经停止,使用系统日志和logrotate似乎是一个合理的解决scheme)。
我已经将Apache的错误日志发送到local7,并通过logging器程序将访问日志传送到local6。
我希望Syslog分别将错误和访问日志写入/var/log/apache2/error.log和/var/log/apache2/access.log 。
为此,我在/etc/syslog.conf添加了以下内容:
# Logging for Apache using local7 facility for error messages # and local6 for access log # Added 20/06/2010 by Chris Bunney local7.* /var/log/apache2/error.log local6.* /var/log/apache2/access.log
我知道错误和访问日志正在发送到Syslog,因为它们出现在/var/log/syslog ,但是它们没有被写入到我想要的文件中。
目标文件的原始文件权限:
-rw-r----- 1 root adm 0 2010-06-20 23:01 access.log
我一直使用的目标文件的当前文件许可权尝试排除这样的事情导致的问题:
-rw-rw-rw- 1 syslog adm 0 2010-06-20 23:01 access.log
一切看起来都很好,所以为什么Syslog正在收到的消息被写入我想要的文件呢? 我错过了简单的事情吗?
cat /etc/syslog.conf完整输出:
# /etc/syslog.conf Configuration file for syslogd. # # For more information see syslog.conf(5) # manpage. # # First some standard logfiles. Log by facility. # auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog cron.* /var/log/cron.log daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log user.* -/var/log/user.log # # Logging for the mail system. Split it up so that # it is easy to write scripts to parse these files. # mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err /var/log/mail.err # Logging for INN news system # news.crit /var/log/news/news.crit news.err /var/log/news/news.err news.notice -/var/log/news/news.notice # Logging for Apache using local7 facility for error messages # and local6 for access log # Added 20/06/2010 by Chris Bunney local7.* /var/log/apache2/error.log local6.* /var/log/apache2/access.log # # Some `catch-all' logfiles. # *.=debug;\ auth,authpriv.none;\ news.none;mail.none -/var/log/debug *.=info;*.=notice;*.=warn;\ auth,authpriv.none;\ cron,daemon.none;\ mail,news.none -/var/log/messages # # Emergencies are sent to everybody logged in. # *.emerg * # # I like to have messages displayed on the console, but only on a virtual # console I usually leave idle. # #daemon,mail.*;\ # news.=crit;news.=err;news.=notice;\ # *.=debug;*.=info;\ # *.=notice;*.=warn /dev/tty8 # The named pipe /dev/xconsole is for the `xconsole' utility. To use it, # you must invoke `xconsole' with the `-file' option: # # $ xconsole -file /dev/xconsole [...] # # NOTE: adjust the list below, or you'll go crazy if you have a reasonably # busy site.. # daemon.*;mail.*;\ news.err;\ *.=debug;*.=info;\ *.=notice;*.=warn |/dev/xconsole
你重新启动syslogd? 您也可以使用lsof -f -p <pid-of-syslogd>查看它打开的日志文件。 syslog.conf看起来不错,你可能想要发布你的apacheconfiguration。
对于从Ubuntu LTS 12.04到14.04.1更新之后在search时出现类似症状的用户,系统日志被rsyslog取代,这是由于某种原因未能通过分发升级安装的。
解决办法是apt-get install rsyslog