Joe’s Blog!

I recently setup a rsyslog server for my employer. Rsyslog is an enhanced syslog server that is multi-threaded. There is all sorts of filtering and rules that can be setup in the configuration. Cool stuff. In an effort to get as many systems using syslog as I can I needed to track down how to get syslog support built into nginx as a couple of our backend systems use it. The first thing I found was the out of date patch on this page over at the nginx wiki. Unfortunately this doesn’t work for me as I already run 0.7.61. A quick email to the nginx mailing list and I found out about another patch set for 0.7.x and 0.8.x by the same author as the old one. Basically it’s as easy as patching the nginx source with the aforementioned patch and then the standard ./configure, make and make install with one catch. You need to add –with-syslog to your configure. Unfortunately this didn’t seem to work for me I needed to also add the CFLAG to add syslog support in as well by running export CFLAGS=”$CFLAGS -DUSE_SYSLOG”. After that run your build and things should be ready to go. After the make if you want to double check that syslog support got built just run strings objs/nginx | grep openlog if you get “openlog” as a result you should be ready to rock.

Now for your rsyslog setup you may want to have nginx log to its own files rather than the default syslog log file. To do that just add the following to your configuration:

if $programname == 'nginx' and $syslogseverity <= '4' then /var/log/nginx_error.log
if $programname == 'nginx' and $syslogseverity == '5' then /var/log/nginx_access.log
if $programname == 'nginx' and $syslogseverity >= '6' then /var/log/nginx_debug_info.log


This will filter out all the logs for nginx by the severity of the log message. I have all errors go to one (<= 4), access logs (== 5) go to another and debug and info messages (>= 6) go to the last.

For more details on configuring rsyslog check out the wiki.