Forum Discussion
fkuser_104673
Nimbostratus
NimbostratusSend Web Accelerator Logs to external syslog
Hi!
Since thre's no facility associated to Web Accelerator logs, I would like yo know if it's possible sen that logs to a external syslog-ng server.
It's possible to define a "tail source" into syslog-ng config file, adding a line like that:
source s_tail { file("myapp.log" follow_freq(1) flags(no-parse)); };
It is the only way to do this?
Thanks!
hoolioCirrostratus
Which logs are you trying to send externally?
In 9.4.8 and 10.0.1, the default syslog-ng.conf follows /var/run/pvac.pipe and writes the output to /var/lob/wa/pvac.log. Similarly, the /var/run/comm_srv.pipe pipe is written to /var/lob/wa/comm_srv.log.
Aaron- hoolioI haven't tested the option you've suggested or the one below before, but it looks like you could read from a file using the source command:
From man syslog-ng.conf:
NAME
/etc/syslog-ng/syslog-ng.conf - syslog-ng configuration file
DESCRIPTION
The configuration file for syslog-ng
A message route in syslog-ng is made up from three parts: a source, a
destination and filtering rules.
SOURCES
You can declare source statements using the "source" keyword:
source { sourcedriver params; sourcedriver params; ... };
Sourcename is an identifier you'll use to refer to this group of mes-
sages. Sourcedriver is a method of getting a given message. The fol-
lowing drivers are available:
* file - reads messages from the given file
Aaron 
fkuser_104673It doesn't works... at least for me.
The file source driver, sends over and over again the file to the remote syslog server...
One more time, many thanks for the help Aaron.- hoolioSorry for that. I haven't tried testing either option so I'm not sure why that might be happening. You could try opening a case with F5 Support. They'll probably state they don't support customising syslog-ng--but you might find someone who is willing to give you suggestions anyhow.
Aaron