Filter the access_log on the fly (SetEnvIf and CustomLog question)

[Magnus Østergaard <ma...@slackware.adsl.dk>]

Hi,

I want to filter my logs live, so that surtain addresses/information is
logged in different files. My problem is I can't get several rules to
apply of a file.

Here goes

httpd:conf

  # Mark requests from: http://validator.w3.org
  SetEnvIf Remote_Addr "18\.29\.1\.50" validator
  # Mark requests from: http://server.htmlhelp.com
  SetEnvIf Remote_Addr "64\.29\.16\.182" validator

  CustomLog /usr/local/apache/logs/validator_log common env=validator
  CustomLog /usr/local/apache/logs/access_log combined env=!validator

This works okay, 'validator' is now only logged in validator_log, so
lets try one more.

  SetEnvIf Request_URI .png$ images
  CustomLog /usr/local/apache/logs/images_log common env=images

  CustomLog /usr/local/apache/logs/access_log combined env=!images

The images are logged to the image_log, but now access_log logs
everything, both 'validator' and 'images'. How can I tell access_log not
to log validator and images?

I've tried:

  CustomLog /usr/local/apache/logs/access_log combined
env=!images,env=!validator

But this is not working... What am I doing wrong?



-- 
Magnus Østergaard

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: Filter the access_log on the fly (SetEnvIf and CustomLog question)

[Joshua Slive <jo...@slive.ca>]

> # Mark requests from: http://validator.w3.org
> SetEnvIf Remote_Addr "18\.29\.1\.50" validator=1
> # Mark requests from: http://server.htmlhelp.com
> SetEnvIf Remote_Addr "64\.29\.16\.182" validator=1
> CustomLog /usr/local/apache/logs/validator_log common env=validator
> SetEnvIf Request_URI .png$ images=1
> CustomLog /usr/local/apache/logs/images_log common env=images
> SetEnvIf validator 1 gotit
> SetEnvIf images 1 gotit
> CustomLog /usr/local/apache/logs/access_log combined env=!gotit

Actually, just to be pedantic, this is slightly more efficient because it
cuts down on the number of regex evaluations:

SetEnvIf Remote_Addr "18\.29\.1\.50" validator nolog
SetEnvIf Remote_Addr "64\.29\.16\.182" validator nolog
SetEnvIf Request_URI .png$ images nolog

CustomLog /usr/local/apache/logs/validator_log common env=validator
CustomLog /usr/local/apache/logs/images_log common env=images
CustomLog /usr/local/apache/logs/access_log combined env=!nolog

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: Filter the access_log on the fly (SetEnvIf and CustomLog que

[Lars Eilebrecht <la...@hyperreal.org>]

According to Joshua Slive:

> CustomLog /usr/local/apache/logs/access_log combined env=!nolog

"!nolog"? 

"Don't use no double negatives, not never!" ;-)


SCNR...
-- 
Lars Eilebrecht             - Even bytes get lonely for a little bit.
lars@hyperreal.org

---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org

RE: Filter the access_log on the fly (SetEnvIf and CustomLog question)

[Joshua Slive <jo...@slive.ca>]

> # Mark requests from: http://validator.w3.org
> SetEnvIf Remote_Addr "18\.29\.1\.50" validator=1
> # Mark requests from: http://server.htmlhelp.com
> SetEnvIf Remote_Addr "64\.29\.16\.182" validator=1
> CustomLog /usr/local/apache/logs/validator_log common env=validator
> SetEnvIf Request_URI .png$ images=1
> CustomLog /usr/local/apache/logs/images_log common env=images
> SetEnvIf validator 1 gotit
> SetEnvIf images 1 gotit
> CustomLog /usr/local/apache/logs/access_log combined env=!gotit

Actually, just to be pedantic, this is slightly more efficient because it
cuts down on the number of regex evaluations:

SetEnvIf Remote_Addr "18\.29\.1\.50" validator nolog
SetEnvIf Remote_Addr "64\.29\.16\.182" validator nolog
SetEnvIf Request_URI .png$ images nolog

CustomLog /usr/local/apache/logs/validator_log common env=validator
CustomLog /usr/local/apache/logs/images_log common env=images
CustomLog /usr/local/apache/logs/access_log combined env=!nolog

Joshua.

---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org

RE: Filter the access_log on the fly (SetEnvIf and CustomLog question)

[Joshua Slive <jo...@slive.ca>]

> From: mgx@m1.dnsix.com [mailto:mgx@m1.dnsix.com]On Behalf Of Magnus
> Østergaard


> The images are logged to the image_log, but now access_log logs
> everything, both 'validator' and 'images'. How can I tell access_log not
> to log validator and images?

# Mark requests from: http://validator.w3.org
SetEnvIf Remote_Addr "18\.29\.1\.50" validator=1
# Mark requests from: http://server.htmlhelp.com
SetEnvIf Remote_Addr "64\.29\.16\.182" validator=1
CustomLog /usr/local/apache/logs/validator_log common env=validator
SetEnvIf Request_URI .png$ images=1
CustomLog /usr/local/apache/logs/images_log common env=images
SetEnvIf validator 1 gotit
SetEnvIf images 1 gotit
CustomLog /usr/local/apache/logs/access_log combined env=!gotit

Of course, the more efficient way to do this is just to log all to one log
and post-process the log to get what you need.

Joshua.


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org