"Catch-All" access log with Apache Virtual Hosts?

Solution 1:

See http://httpd.apache.org/docs/2.2/logs.html#virtualhost

If CustomLog or ErrorLog directives are placed inside a section, all requests or errors for that virtual host will be logged only to the specified file. Any virtual host which does not have logging directives will still have its requests sent to the main server logs.

In other words, if you place Logging directives within a VirtualHost section, it will override the Logging directives within the main server configuration. If you want to log to a single logfile, then remove the log configuration from your VirtualHost sections.

For simplicity, I prefer to log all Access data to a single logfile. Later, you can process the logs and split the logfiles into logfiles for the Virtual Hosts. Also, writing to a single logfile is a more efficient use of computer resources then writing to 30 logfiles at once. Just make sure your LogFormat includes the '%v', which will log the name of the Virtual Host.

Is it possible to have ALL accesses and errors duplicated to a shared logfile?

You can log all errors and access to a shared logfile, but the logfile is ugly. First, send the Apache log data to syslog, and then use syslog to send to a local file or a remote log server.

# Send access logs to syslog
LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog "|/usr/bin/logger -t httpd -i -p local7.notice" combined
# Send error logs to syslog
ErrorLog syslog:local7

And then in /etc/syslog.conf

# Send all HTTP log data to this file
local7.*        /var/log/http-all.log

Solution 2:

What I did was add a second CustomLog line in the VirtualHost section. But I had to do this for every single vhost conf file. It works and it's in my template now so new vhosts are taken car of.

My apache2 now logs hits to two places:

1. The specifics for a vhost in that vhost's directory and
2. to /var/log/apache2 in a combined file for all vhosts.

I apply a different LogFormat to each of these two logs to accommodate respectively, of course. The /var/log/apache2 log is parsed with Perl and sucked into a highly normalized MySQL structure for analysis and reporting. Logrotate sweeps up once a week.

Solution 3:

well if you just want to see live logs in one place for all virtual hosts you could just type:

tail -f /var/www/*/access.log

the same rule applies for cat with grep:

 cat /var/www/*/access.log | grep "something"

or if log rotate compressed the files already:

gzip -d /var/www/*/access.log.2.gz

examples are tested on Debian/Ubuntu