RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1209165 - [RFE] Multiple ErrorLog directives
Summary: [RFE] Multiple ErrorLog directives
Keywords:
Status: ASSIGNED
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: httpd
Version: 8.4
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Tomas Korbar
QA Contact: rhel-cs-infra-services-qe
URL:
Whiteboard:
Depends On:
Blocks: 1473733 1562205 1654421
TreeView+ depends on / blocked
 
Reported: 2015-04-06 14:25 UTC by Pat Riehecky
Modified: 2023-04-21 10:08 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Apache Bugzilla 57784 0 None None None 2019-06-07 13:19:17 UTC

Description Pat Riehecky 2015-04-06 14:25:02 UTC 
Description of problem:
Our central security team wants all our httpd error logs sent to their central syslogger.  I would like to keep my local log files for my review.

Since ErrorLog has the ability to send to syslog or to a local file, can the behavior be amended so that I can do both?  I can fix up rsyslog to not store the duplicate copies on my own.  

My end goal looks something like:

# my log files
ErrorLog logs/error_log
# logging via syslog
ErrorLog syslog:local7

Currently I am only able to set one destination for ErrorLog, being able to duplicate the targets would be helpful for me.

Version-Release number of selected component (if applicable):
 	httpd-2.4.6-31

How reproducible:100%


Steps to Reproduce:
1.Enter multiple ErrorLog directives
2.Generate an error
3.Note where it is logged

Actual results:
Only one ErrorLog used

Expected results:
Error logged to all listed locations

Additional info:
Comment 5 Joe Orton 2017-02-07 12:54:59 UTC 
If this is still a priority for you can you file a support ticket?

Possibly this is something we could do for httpd >= 2.5.
Comment 7 Pat Riehecky 2017-02-07 14:45:09 UTC 
Ticket opened
Comment 8 Joe Orton 2017-02-07 14:46:56 UTC 
Thanks Pat.  I don't want to raise expectations too high here, it might be something that we can do in RHEL7 httpd, but we can look at it for the future.
Comment 10 Pat Riehecky 2018-10-03 17:01:37 UTC 
Any news on this?
Comment 12 Pat Riehecky 2019-10-03 19:42:05 UTC 
Just swinging back around on this one....
Comment 15 Joe Orton 2020-09-03 12:50:48 UTC 
Moving to the RHEL8 backlog.  I have some ideas about how to implement this upstream, but it's quite a tricky one.
Comment 27 Tomas Korbar 2023-04-11 13:09:52 UTC 
Hi Patrick,
Would the possibility to define both log file and syslog facility be sufficient to you?
like this:
ErrorLog "logs/error_log"
ErrorLog syslog:local6

Httpd would be logging both to syslog and file, but there would be limitation that there
can still be only one log file.

Thanks for any response.
Comment 28 Pat Riehecky 2023-04-13 14:02:06 UTC 
My ideal world would be where I can set multiple logfiles and a syslog stream. ie:

ErrorLog "logs/error_log"
ErrorLog "logs/sitename.example.com/error_log"
ErrorLog syslog:local6

For my actual use case, one log file and a syslog stream would be sufficient. ie:
ErrorLog "logs/error_log"
ErrorLog syslog:local6
Comment 29 Tomas Korbar 2023-04-19 12:29:54 UTC 
You will be able to achieve this with pipe to tee utility.

More specifically your multiple log files use case:
ErrorLog "logs/error_log"
ErrorLog "logs/sitename.example.com/error_log"
ErrorLog syslog:local6

Will look like:
ErrorLog "| /usr/bin/tee logs/error_log logs/sitename.example.com/error_log"
ErrorLog syslog:local6
Comment 30 Pat Riehecky 2023-04-20 19:21:33 UTC 
So long as I can specify multiple elements, I'm fine with that.

I can confirm on CentOS Stream 9 (roughly RHEL 9.2) that whatever is the last element specified is the only one used currently.
Note You need to log in before you can comment on or make changes to this bug.