All,
We have legacy servers going years back and newer ones etc. Basically, we have ended up with about 30 different settings in httpd.conf for logging. They asked me what I want the standard to be for Splunk reasons. Started to think about that, and is there any reason why I shouldn't directly ask for CIM friendly key value pairs rights now in the source?
LogFormat
%t src_ip=%h RemoteLogName=%l RemoteUser=%u request=\"%r\" %>s %b \"%{Referer}i\" http_user_agent=\"%{User-Agent}i\"
Example:
[17/Aug/2016:20:20:27 -0400] src_ip=192.168.1.47 RemoteLogName=- RemoteUser=- request="GET /default.html HTTP/1.1" 304 - "-" http_user_agent="Mozilla/5.0 (Macintosh; Inte....
↧