Install Guide
Overview
Collects access log and error log files of Apache HTTP Server. Sonar connects to the web server over SSH (SFTP) to read the log files. If a Logpresso node can read the log directory directly, the log files can also be collected as local files. Access logs are shown on the dashboard provided by the app.
Scope
Requirements
| Item | Requirement | Remarks |
|---|---|---|
| Access log | Combined log format | See Step 1: Check Log Format below |
| Error log | Default error log format of Apache HTTP Server 2.4 | Logs in the 2.2 format or a custom ErrorLogFormat are collected as unclassified |
| File access permission | Read permission on the log directory and log files | Sonar collector node account for local collection, SSH account for SFTP collection |
| Network access (for SFTP) | TCP/22 (Sonar collector node → Apache HTTP server, outbound) | Not required for local file collection |
Apache HTTP Server Configuration
Step 1: Check Log Format
Access logs must use the following Combined format. Check that the CustomLog directive in the Apache configuration file uses this format.
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog "logs/access_log" combined
Error logs are collected in the default format, without a custom ErrorLogFormat. Logs in other formats are still collected, but their fields are not parsed and they are classified as unclassified.
Step 2: Check Log File Location
Apache HTTP Server writes log files to the following paths depending on the distribution. If you configured separate log files per virtual host, check the paths in the CustomLog and ErrorLog directives of the Apache configuration.
| Distribution | Directory path | Access log | Error log |
|---|---|---|---|
| RHEL family | /var/log/httpd | access_log | error_log |
| Debian/Ubuntu | /var/log/apache2 | access.log | error.log |
For SFTP collection, check the owner and permissions of the log directory and log files, and make sure the Logpresso login account can read the log files. Restrict the account so that it can read only the Apache HTTP server logs.
Logpresso Collection Setup
Register a separate logger for access logs and for error logs. For SFTP collection, both loggers use the same SSH connect profile.
Step 1 (for SFTP remote file collection): Add an SSH Connect Profile
To collect log files from a remote web server over SFTP, register the connection information as a connect profile first. Skip this step for local file collection. Go to System > Connect Profiles, click Add, and enter the following values.
| Type | Item | Setting |
|---|---|---|
| Required | Name | A unique name that identifies the connect profile. e.g., Apache SSH |
| Required | Identifier | A unique identifier used in Logpresso queries. e.g., ssh-example |
| Required | Type | Select SSH |
| Required | Host | IP address or host name of the Apache HTTP server |
| Required | Port | SSH port. Defaults to 22 |
| Required | Account | SSH account with read permission on the log directory |
| Required | Authentication type | Select Auth key or Password |
| Conditional | Password | Account password when the authentication type is Password |
| Required | Timeout | Connection timeout in seconds. Defaults to 30 |
| Optional | Keep alive | Keep-alive interval in milliseconds. The default is used if left empty |
If you use an auth key, click Set public key to view the steps for enabling key-based SSH authentication on the web server and the SSH public key of Sonar. Follow the steps to add the public key to the authorized_keys file of the login account.
When you are done, run the following in the query screen and check that the log file content is returned. Change the path to match your environment.
Check the error log in the same way.
Step 2: Add an Access Log Logger
Go to Collect > Loggers, click Add, and enter the following values.
| Type | Item | Setting |
|---|---|---|
| Required | Name | A unique name that identifies the logger. e.g., Apache Access |
| Required | Execution mode | Select Interval |
| Required | Interval | Collection interval in seconds. e.g., 5 |
| Required | Storage location | Select the node that stores the logs |
| Optional | Collection location | Select the sentry that performs the collection |
| Required | Logger model | Select Apache HTTP Server - SFTP |
| Required | Table | A table name that starts with WEB_APACHE_. e.g., WEB_APACHE_ACCESS |
| Required | SSH profile | The connect profile registered in Step 1. e.g., ssh-example |
| Required | Directory path | Absolute path of the log directory. e.g., /var/log/httpd |
| Required | Filename pattern | A regular expression that matches the access log file name. e.g., access_log |
The dashboard provided by the app reads tables whose names start with WEB_APACHE_, so use a table name that starts with WEB_APACHE_.
The filename pattern is a regular expression that must match the whole file name. Specify only the access log file so that error logs in the same directory are not collected together. On Debian/Ubuntu, enter access\.log.
Step 3: Add an Error Log Logger
Go to Collect > Loggers, click Add, and enter the following values.
| Type | Item | Setting |
|---|---|---|
| Required | Name | A unique name that identifies the logger. e.g., Apache Error |
| Required | Execution mode | Select Interval |
| Required | Interval | Collection interval in seconds. e.g., 5 |
| Required | Storage location | Select the node that stores the logs |
| Optional | Collection location | Select the sentry that performs the collection |
| Required | Logger model | Select Apache HTTP Server Error - SFTP |
| Required | Table | A table name that does not start with WEB_APACHE_. e.g., APACHE_ERROR |
| Required | SSH profile | The connect profile registered in Step 1. e.g., ssh-example |
| Required | Directory path | Absolute path of the log directory. e.g., /var/log/httpd |
| Required | Filename pattern | A regular expression that matches the error log file name. e.g., error_log |
On Debian/Ubuntu, enter error\.log as the filename pattern.
If a Logpresso node can read the log directory of the Apache HTTP server directly, select Apache HTTP Server - File or Apache HTTP Server Error - File as the logger model to collect local files without a connect profile. In this case, the SSH profile item is not shown, and the collection location must be the node where the log directory is located.
Post-Installation Verification
Run the following query to verify that collection works. Replace the table names with the values you entered in Steps 2 and 3.
- Normal: The
WEB_APACHE_ACCESStable has 1 or more records. TheAPACHE_ERRORtable may be empty if no errors occurred in the last 10 minutes, which is also normal. - Abnormal: If
WEB_APACHE_ACCESShas no results even though there were web requests, check the host, account, and authentication settings in the connect profile, the read permission of the login account on the log files, and the directory path and filename pattern of the loggers. - Collection error: If the logger status shows an error, check the cause in the error details of the logger.