"Catch-All" access log with Apache Virtual Hosts?

See http://httpd.apache.org/docs/2.2/logs.html#virtualhost

If CustomLog or ErrorLog directives are placed inside a section, all requests or errors for that virtual host will be logged only to the specified file. Any virtual host which does not have logging directives will still have its requests sent to the main server logs.

In other words, if you place Logging directives within a VirtualHost section, it will override the Logging directives within the main server configuration. If you want to log to a single logfile, then remove the log configuration from your VirtualHost sections.

For simplicity, I prefer to log all Access data to a single logfile. Later, you can process the logs and split the logfiles into logfiles for the Virtual Hosts. Also, writing to a single logfile is a more efficient use of computer resources then writing to 30 logfiles at once. Just make sure your LogFormat includes the '%v', which will log the name of the Virtual Host.

Is it possible to have ALL accesses and errors duplicated to a shared logfile?

You can log all errors and access to a shared logfile, but the logfile is ugly. First, send the Apache log data to syslog, and then use syslog to send to a local file or a remote log server.

# Send access logs to syslog LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined CustomLog "|/usr/bin/logger -t httpd -i -p local7.notice" combined # Send error logs to syslog ErrorLog syslog:local7 

And then in /etc/syslog.conf

# Send all HTTP log data to this file local7.* /var/log/http-all.log 

What I did was add a second CustomLog line in the VirtualHost section. But I had to do this for every single vhost conf file. It works and it's in my template now so new vhosts are taken car of.

My apache2 now logs hits to two places:

1. The specifics for a vhost in that vhost's directory and
2. to /var/log/apache2 in a combined file for all vhosts.

I apply a different LogFormat to each of these two logs to accommodate respectively, of course. The /var/log/apache2 log is parsed with Perl and sucked into a highly normalized MySQL structure for analysis and reporting. Logrotate sweeps up once a week.

well if you just want to see live logs in one place for all virtual hosts you could just type:

tail -f /var/www/*/access.log 

the same rule applies for cat with grep:

 cat /var/www/*/access.log | grep "something" 

or if log rotate compressed the files already:

gzip -d /var/www/*/access.log.2.gz 

examples are tested on Debian/Ubuntu

I don't think this is possible. At least the documentation does not mention such thing.

Best way to simulate this sort of behaviour is to define the %v tag in the format and at log rotation split a copy of the log files to virtual host specific files.

I don't know if your log file locations follow any sort of pattern across the virtualhosts, but if they do I would forget about having Apache create a duplicate log and just cat the logs when I need them.

cat /var/www/*/log/access.log > /var/www/logs/access.log 

I'm looking for an answer to this question as well. So far, I have two solutions:

1. the cat solution joebert mentioned
2. my own tail solution: tail -f /var/log/httpd/*access_log

I want to be able to see a tail -f sort of view into all web server activity on the host. I would much rather be able to tail just one file, however, as I don't really like the way tail handles multiple files.

You have 2 possibilities using ErrorLog directive http://httpd.apache.org/docs/2.2/mod/core.html#errorlog

1) Use syslog and handle the duplication in [r]syslog.conf

2) Use pipe, send the log entry to an application/script and handle the duplication in that application/script

Is watching all access logs strictly necessary? If the errors are actually caused by a request for a vhost, there should be something logged in the vhost error log. In that case, ls -t /var/www/*/log/error.log to determine which vhost is the culprit and then watching just that access log file would seem to be a good first step to eliminate a lot of needless log reading.