用syslog实现apache远程日志服务器

1、vi httpd.conf
将
ErrorLog logs/error_log
LogLevel warn
CustomLog logs/access_log combined              
改为
ErrorLog "| /usr/bin/logger -t httpd -p local4.info"
LogLevel notice
CustomLog "| /usr/bin/logger -t apache -p local5.info" combined
2、vi /etc/syslog.conf,添加
local4.info                                            /var/log/error_log.log
local5.*                                               /var/log/access_log.log
*.*;mail.none;authpriv.none;cron.none;kern.none;local7.none   @10.31.0.226
3、重启httpd及syslog服务
service httpd restart
service syslog restart
4、进入远程主机，vi /etc/sysconfig/syslog，修改
SYSLOGD_OPTIONS="-m 0"  为
SYSLOGD_OPTIONS="-r -m 0"
 
vi /etc/syslog.conf，添加
local4.*                                                /var/log/error_log.log
local5.*                                                /var/log/access_log.log
即可。
 
5、vi /etc/logrotate.conf
添加如下行：
#apache log
/var/log/error_log.log{
    daily
    create
    rotate 1
    prerotate
   /usr/bin/chattr -a /var/log/error_log.log
   endscript
   postrotate
   /usr/bin/killall -HUP syslogd
   /usr/bin/chattr +a /var/log/error_log.log
   mv /var/log/error_log.log.1 /opt/log/error_log.`date -d "-1 days"+%Y%m%d`
   gzip /opt/log/error_log.`date -d "-1 days" +%Y%m%d`
   endscript
}
/var/log/access_log.log{
    daily
    create
    rotate 1
    prerotate
   /usr/bin/chattr -a /var/log/access_log.log
   endscript
   postrotate
   /usr/bin/killall -HUP syslogd
   /usr/bin/chattr +a /var/log/access_log.log
   mv /var/log/access_log.log.1 /opt/log/access_log.`date -d "-1 days" +%Y%m%d`
   gzip /opt/log/access_log.`date -d "-1 days" +%Y%m%d`
   endscript
}