Apache HTTP server configuration using syslog

This section describes how to send logs from Apache HTTP Server using syslog and syslog-NG.

To configure Apache HTTP server using syslog:

Log in to the server that hosts Apache as the root user.
Edit the Apache configuration file httpd.conf.
Add the following information in the Apache configuration file to specify the custom log format:
```
LogFormat "%h %A %l %u %t \"%r\" %>s %p %b" <log format name>
```
where <log format name> is a variable name you provide to define the log format.
Add the following information in the Apache configuration file to specify a custom path for the syslog events:
```
CustomLog "|/usr/bin/logger -t httpd -p <facility>.<priority>" <log format name>
```
where:
- <facility> is a syslog facility, for example, local0.
- <priority> is a syslog priority, for example, info or notice.
- <log format name> is a variable name that you provide to define the custom log format. The log format name must match the log format that was defined in the previous step.
For example:
```
CustomLog "|/usr/bin/logger -t httpd -p local1.info" MyApacheLogs
```
Disable hostname lookup:
```
HostnameLookups off
```
Save the Apache configuration file.
Edit the syslog configuration file:
```
/etc/syslog.conf
```
Add the following information to your syslog configuration file:
```
<facility>.<priority> <TAB><TAB>@<host>
```
where:
- <facility> is the syslog facility, for example, local0. This value must match the value that you typed in the previous step.
- <priority> is the syslog priority, for example, info or notice. This value must match the value that you typed in step d.
- <TAB> indicates you must press the Tab key.
- <host> is the IP address of the Trellix Comm Broker Sender.
Save the syslog configuration file.
Restart the syslog service:
```
/etc/init.d/syslog restart
```
Restart Apache to complete the syslog configuration.

To configure Apache HTTP server using syslog-ng:

Log in to the server that hosts Apache, as the root user.
Edit the Apache configuration file:
```
/etc/httpd/conf/httpd.conf
```
Add the following to the Apache configuration file to specify the LogLevel:
```
LogLevel info
```
Note
The LogLevel might already be configured to the info level; it depends on your Apache installation.
Add the following to the Apache configuration file to specify the custom log format:
```
LogFormat "%h %A %l %u %t \"%r\" %>s %p %b" <log format name>
```
where <log format name> is a variable name you provide to define the custom log format.
Add the following to the Apache configuration file to specify a custom path for the syslog events:
```
CustomLog "|/usr/bin/logger -t ’httpd’ -u /var/log/httpd/apache_log.socket" <log format name>
```
Note
The log format name must match the log format that is defined in the previous step.
Save the Apache configuration file.
Edit the syslog-ng configuration file:
```
/etc/syslog-ng/syslog-ng.conf
```

Add the following information to specify the destination in the syslog-ng configuration file:

source s_apache { 
    unix-stream("/var/log/httpd/apache_log.socket"
    max-connections(512)
    keep-alive(yes));
};
destination auth_destination { <udp|tcp> ("<IP address>" port(514)); };
log{
    source(s_apache);
    destination(auth_destination);
};

where:

<IP address> is the IP address of the Trellix Comm Broker Sender.
<udp|tcp> is the protocol that you select to forward the syslog event.

Save the syslog-ng configuration file.
Restart syslog-ng:
```
service syslog-ng restart
```