On Mon, May 13, 2013 at 10:25:50AM -0600, Kevin Fenzi wrote:
On Mon, 13 May 2013 12:10:15 -0400
seth vidal <skvidal(a)fedoraproject.org> wrote:
> The ways I know of to collect/store httpd logs are:
> 1. rsyncing after the fact
> 2. redir out to logger to dump to syslog
> 3. other syslog-redirection trick
> 4. direct-to-mysql log writes.
>
> I'm sure there are lots of variations on 3 using non-syslog to
> replicate the logs.
>
> the disadvantage of 1 is that we don't get the logs from 'just now' if
> something goes wrong. That's where we are now. The second issue is
> that we have to constantly update that list of hosts/files to
> replicate those logs.
Yeah.
> the disad of 2 and 3 is that http logs can kick the crap out of syslog
> in short order. it may, however, be worth trying it with our system to
> see how much damage the httpd logs do.
>
> the disad of 4 is the dep on a db server (and the disads from 1)
>
> thoughts on trying to log http to rsyslog/log02?
well, we do have the fas servers sending error_log messages there, I'd
really be worried that it wouldn't be able to keep up. Especially since
some of our web apps are really really noisy. ;(
If you want to see if it breaks real quickly -- fas's access_log is probably
the quickest growing log (although that may change once fas_openid is
prevalent).
-Toshio