Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm working on an apache logs analyser, it requires the apache log files to be imported into a directory for processing. I cannot simply point it to the apache logs directory as it imports each file before deleting it. It also has no concept of duplicate records, so I cannot set up a cron to copy /var/log/apache2/* into the folder.

I assume logrotate is the best place to do this, but I don't have a clue where to start to configure it. So my question is:

How can I configure logrotate to SSH rotated apache log files to a remote host automatically?

The alternative is to copy locally and run scp & rm via cron, but a one-step SSH process would be nice.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Look at the prerotate and postrotate configuration options (examples in man logrotate). You could for instance have a prerotate that scps the file (make sure you configure SSH keys properly; your root user should be able to ssh to the target system without needing a password). This would copy the access.log file before rotating (renaming, compressing, etc) it.

Note that in this case you would lose any accesses that happen between the copying of the file and the rotation step, so you could also put this in the postrotate section but copy access.log.1 instead.

in /etc/logrotate/apache2 (this may be different, I only have access to a Debian system) you can add the prerotate section so the contents of the file look like this:

/var/log/apache2/*.log {
    weekly
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 640 root adm
    sharedscripts
    postrotate
        /etc/init.d/apache2 reload > /dev/null
    endscript
    prerotate
        scp /var/log/apache2/access.log you@elsewhere.com
    endscript
}
share|improve this answer
    
The prerotate looks like the sort of thing I'm after. Thanks :) –  Valorin Aug 16 '12 at 13:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.