Apache logs to mysql?

[jeffschips]

Hello.

All of the online tutorials for putting apache logs into mysql address Ubuntu or Debian, but as you know, Cpanel/WHM uses Centos.

I have the latest build Centos 7.6 and wish to put the logs for one virtual domain into mysql. The tutorials for Ubuntu and Debian reference a mod_log_sql that needs to be used for those flavors and yum install mod_log_sql returns nothing.

Anybody have some wisdom here on how to log domain logs to MySQL in Centos 7.6 on WHM/Cpanel?

Thank you.

 

[sparek-3]

How old are those tutorials you are reading?

I don't think mod_log_sql has been an active project since the mid 2000's

 

[jeffschips]

Looking for advice on how to capture apache logs into mysql. Perhaps you know of a way to do this...

 

[garconcn]

You can use rsyslog on cpanel to send apache log to LogAnalyzer server and then write it into mysql.

Eg: /etc/rsyslog.conf

# Forward Apache Access Log to LogAnalyzer Server
$InputFileName /usr/local/apache/logs/access_log
$InputFileTag apache-access
$InputFileStateFile stat-apache-access
$InputFileSeverity warn
$InputFileFacility local5
$InputRunFileMonitor

# Forward Apache access-log to contral log server
if $syslogtag contains 'apache-access' and $msg contains 'wp-login.php' then @192.168.1.1
if $syslogtag contains 'apache-access' and $msg contains 'xmlrpc.php' then @192.168.1.1

 

[jeffschips]

Indeed this sounds like a great solution.
Should I proceed assuming that rsyslog is the standard logging facility in cpanel/WHM and not syslog?

when I ps aux | grep syslog

I only see:

/usr/sbin/rsyslogd -n

so I'm assuming it's safe to proceed.

 

[cPanelLauren]

Hi @jeffschips

rsyslog is just the advanced version of syslog they function the same. For more information, you can read the man page for it or check here: rsyslogd(8): reliable/extended syslogd - Linux man page

@sparek-3 thanks for the great advice in here.

 

[garconcn]

Indeed this sounds like a great solution.
Should I proceed assuming that rsyslog is the standard logging facility in cpanel/WHM and not syslog?

when I ps aux | grep syslog

I only see:

/usr/sbin/rsyslogd -n

so I'm assuming it's safe to proceed.

I remember centos 5 was using syslog, centos 6&7 use rsyslog, they are similar, both will work. Let me know if you need more info. I've played with this several years ago, but I still have the configurations.