Logging Apache to syslog.

Maybe everybody already knows this. I did not. Apache does not log to syslog. It logs to a file or a program.

However, util-linux provides a program named logger that writes to syslog. It can be used directly with apache to proxy log entries to syslog. You just need to configure it via the CustomLog directive.

CustomLog " |/usr/bin/logger -t 'apache'" combined

I have also seen suggestions to use a dedicated socket to receive Apache log entries. I am not sure what the reason for this is, I would assume that logger uses internal syslog calls by default which would perform better than a UNIX socket. However, if you want to test this method as well, you will need to add a new source to /etc/syslog-ng/syslog-ng.conf:

source s_apache {
	unix-stream ("/dev/log_apache" max-connections(512) keep-alive(yes));
};

Then the CustomLog directive in the httpd.conf changes slightly:

CustomLog " |/usr/bin/logger -t 'apache' -u /dev/log_apache" combined

Previously, I was using a python script to do the same job. I am glad to retire my python script :-).