Getting Data In
Highlighted

httpd.conf configuration for logging recommendation?

Builder

All,

We have legacy servers going years back and newer ones etc. Basically, we have ended up with about 30 different settings in httpd.conf for logging. They asked me what I want the standard to be for Splunk reasons. Started to think about that, and is there any reason why I shouldn't directly ask for CIM friendly key value pairs rights now in the source?

LogFormat

%t src_ip=%h RemoteLogName=%l RemoteUser=%u request=\"%r\" %>s %b \"%{Referer}i\" http_user_agent=\"%{User-Agent}i\"

Example:

[17/Aug/2016:20:20:27 -0400] src_ip=192.168.1.47 RemoteLogName=- RemoteUser=- request="GET /default.html HTTP/1.1" 304 - "-" http_user_agent="Mozilla/5.0 (Macintosh; Inte....
0 Karma
Highlighted

Re: httpd.conf configuration for logging recommendation?

Ultra Champion

If you have this "luxury" you can try to conform your data to the Splunk industry standard one from - List of pretrained source types

This can be pretty cheerful if you manage to do it - one of my dreams in my current place ; - )

0 Karma