用syslog实现apache远程日志服务器

1、vi httpd.conf
将
ErrorLog logs/error_log
LogLevel warn
CustomLog logs/access_log combined
改为
ErrorLog "| /usr/bin/logger -t httpd -p local4.info"
LogLevel notice
CustomLog "| /usr/bin/logger -t apache -p local5.info" combined
2、vi /etc/syslog.conf,添加
local4.info /var/log/error_log.log
local5.* /var/log/access_log.log
*.*;mail.none;authpriv.none;cron.none;kern.none;local7.none @10.31.0.226
3、重启httpd及syslog服务
service httpd restart
service syslog restart
4、进入远程主机，vi /etc/sysconfig/syslog，修改
SYSLOGD_OPTIONS="-m 0" 为
SYSLOGD_OPTIONS="-r -m 0"

vi /etc/syslog.conf，添加
local4.* /var/log/error_log.log
local5.* /var/log/access_log.log
即可。

5、vi /etc/logrotate.conf
添加如下行：
#apache log
/var/log/error_log.log{
daily
create
rotate 1
prerotate
/usr/bin/chattr -a /var/log/error_log.log
endscript
postrotate
/usr/bin/killall -HUP syslogd
/usr/bin/chattr +a /var/log/error_log.log
mv /var/log/error_log.log.1 /opt/log/error_log.`date -d "-1 days"+%Y%m%d`
gzip /opt/log/error_log.`date -d "-1 days" +%Y%m%d`
endscript
}
/var/log/access_log.log{
daily
create
rotate 1
prerotate
/usr/bin/chattr -a /var/log/access_log.log
endscript
postrotate
/usr/bin/killall -HUP syslogd
/usr/bin/chattr +a /var/log/access_log.log
mv /var/log/access_log.log.1 /opt/log/access_log.`date -d "-1 days" +%Y%m%d`
gzip /opt/log/access_log.`date -d "-1 days" +%Y%m%d`
endscript
}