1

I am trying to write a simple apache piped logging directive and I am getting a failure. I just want to grep out 200 response codes for centralizing my log files to ELK. This is the custom log format that I created.

LogFormat "%s %h %l %u %t \"%r\" %b" remove

Here is the piped log

CustomLog "|/bin/grep -v '^200' /var/log/apache2/pi-mirror.com/access.log" remove

I get the following error in the apache2 error log. 

AH00106: piped log program '/bin/grep -v '^200' /var/log/apache2/pi-mirror.com/access.log' failed unexpectedly

I cannot seem to figure out what is going on here. I read through apaches docs on piped logging and I can't find anything that I could be doing incorrectly.

This is running on Apache2 2.4.7

Thanks in advance for the assistance.

NOTE

Looking into this further I found that apache 2.2 and apache 2.4 changed the way this is done. Previously a shell was spawned automatically but in the new 2.4 version you must manually specify a shell. As a result I changed my syntax to this

CustomLog "|$/bin/grep -v '^200' /var/log/apache2/pi-mirror.com/access.log" remove

This change has done the following. For some reason when I restart apache2 it spits out all the output of that command to stdout and I see it all from my terminal. But then it fails with the same error message. It's almost like apache is failing to actually start this repetitively which makes me wonder if I need to do something else to fix this.

stobiewankenobi
  • 143
  • 3
Christopher
  • 11
  • 1
  • 2

1 Answers1

1

The problem is that your grep is trying to filter the log on disk but when you use the CustomLog with a pipe all new log messages are sent to that rather than the file so the file does not exist. What you probably actually want is:

CustomLog "|/bin/grep -v '^200' | cat >> /var/log/apache2/pi-mirror.com/access.log" remove

What that will do is a reverse grep for 200 (what you originally had), then it will echo it into the log file. For more information see: https://workshop.avatarnewyork.com/post/filtering-apache-piped-logs-to-centralize-logging-of-errors-and-warnings/

ssgelm
  • 161
  • 1
  • 5