Rsyslog with Central loghost

Server Konfiguration:

#vi /etc/rsyslog.conf

$IncludeConfig /etc/rsyslog.d/*

$ModLoad imuxsock.so
$ModLoad imklog.so
#$ModLoad ommysql

#load the network stuff
$ModLoad imudp.so
$UDPServerRun 514

$ModLoad imtcp
$InputTCPServerRun 514

#reduce any duplicates
$RepeatedMsgReduction on

# The template that wil format the message as it is writen to the file
# you can edit this line if you want to customize te message format
$template TraditionalFormat,”%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n”

# this line creates a template that will store the messages for each host in a seperate file.
# a new file will ben created daily because of the date in the filename.
$template DailyPerHostLogs,”/var/opt/syslog/%HOSTNAME%/%HOSTNAME%.%$YEAR%-%$MONTH%-%$DAY%.log”

#This line creates a sinlge log file for each server with the content of all content all logs from the client.
*.* -?DailyPerHostLogs;TraditionalFormat

 

#vi /etc/rsyslog.d/10-remote.conf

###APACHE START###
$template apacheError,”/var/opt/syslog/%fromhost%/apache/%$YEAR%-%$MONTH%-%$DAY%.error.log”
$template apacheAccess,”/var/opt/syslog/%fromhost%/apache/%$YEAR%-%$MONTH%-%$DAY%.access.log”

local7.* ?apacheError
& ~

local6.notice ?apacheAccess
& ~
##APACHE END###
#
###MAIL START###
$template mailInfo, “/var/opt/syslog/%fromhost%/mail/%$YEAR%-%$MONTH%-%$DAY%maillog”

mail.* ?mailInfo
& ~
###MAIL END###
#
###SECURE START###
$template secureLog, “/var/opt/syslog/%fromhost%/secure/%$YEAR%-%$MONTH%-%$DAY%secure.log”

authpriv.*    -?secureLog
& ~
###SECURE END###

#
###LDAP START###
$template ldapLog, “/var/opt/syslog/%fromhost%/ldap/%$YEAR%-%$MONTH%-%$DAY%ldap.log”

local4.*        ?ldapLog
& ~
###LDAP END###

 

 

On the apache server we need to add:

#vi  /etc/httpd/conf.d/logging.conf

CustomLog “|/usr/bin/logger -t apache -i -p local6.notice” combined

ErrorLog  syslog:local3
LogLevel warn

 

 

 

The folder structure and logs do look like this:

root@loghost:/var/opt/syslog/www04.domain.com# ll
total 20
drwx—— 5 root root 4096 May 22 14:07 ./
drwxrwxrwx 9 root root 4096 May 23 00:00 ../
drwx—— 2 root root 4096 May 26 00:00 apache/
drwx—— 2 root root 4096 May 26 00:09 mail/
drwx—— 2 root root 4096 May 26 00:00 secure/
drwx—— 2 root root 4096 May 26 00:00 ldap/