Getting Data In

httpd.conf configuration for logging recommendation?



We have legacy servers going years back and newer ones etc. Basically, we have ended up with about 30 different settings in httpd.conf for logging. They asked me what I want the standard to be for Splunk reasons. Started to think about that, and is there any reason why I shouldn't directly ask for CIM friendly key value pairs rights now in the source?


%t src_ip=%h RemoteLogName=%l RemoteUser=%u request=\"%r\" %>s %b \"%{Referer}i\" http_user_agent=\"%{User-Agent}i\"


[17/Aug/2016:20:20:27 -0400] src_ip= RemoteLogName=- RemoteUser=- request="GET /default.html HTTP/1.1" 304 - "-" http_user_agent="Mozilla/5.0 (Macintosh; Inte....
0 Karma

Ultra Champion

If you have this "luxury" you can try to conform your data to the Splunk industry standard one from - List of pretrained source types

This can be pretty cheerful if you manage to do it - one of my dreams in my current place ; - )

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.