Trying to log to a central syslog server, either direct using Apache's ErrorLog to pipe to logger, or getting syslog to forward, but nothing is working and the errors are not making sense to me. I can get the Custom log to work, but not ErrorLog. Using Apache/2.4.7 on Ubuntu 14.04 with rsyslogd 7.4.4.
Config in my vhost (with and without space after logger options makes no difference):
LogLevel warn
ErrorLog "|/usr/bin/tee -a /var/log/apache2/error.log | /usr/bin/logger -tapache_err -plocal1.error"
CustomLog "|/usr/bin/logger -p local4.warning -t apache" combined
and then getting this error:
/usr/bin/tee: invalid option -- 't'
Also tried (with and without double quotes):
ErrorLog "|syslog:local1"
But then got:
(2)No such file or directory: AH00089: Couldn't start ErrorLog process 'syslog:local1'.
AH00015: Unable to open logs
Even tried:
ErrorLog "| /usr/bin/tee -a /var/log/apache2/error.log | nc -u -j xxx.xxx.xxx.xxx 514"
But then tee is still complaining:
/usr/bin/tee: invalid option -- 'u'
Why on earth is tee picking up options after the second pipe and what can I do to stop that? I am a but stuck, Google isn't my friend, and any other advice is appreciated.
Best Answer
The first pipe is code for Apache to fork a new command, but it's probably not forking a whole new shell, which would allow you to use a new pipe, but instead exec'ing the command, so everything is treated as a command argument, including the new pipe etc. You can likely go around it by wrapping it into a shell, using two methods, one is explicitly:
And the other is implicitly, using the prefix keyword
|$:The root cause is a change in Apache 2.4, cf. http://httpd.apache.org/docs/2.4/upgrading.html:
On Unix platforms, piped logging commands configured using either ErrorLog or CustomLog were invoked using /bin/sh -c in 2.2 and earlier. In 2.4 and later, piped logging commands are executed directly. To restore the old behaviour, see the piped logging documentation.