Since Apache doesn’t provide the possibility to send it’s logs to a remote server we use the
PIPE loging capability as follows:
Principle:
======
1) – Send logs to a local script via STDOUT
2) – The script uses the command logger to send each log line to the local rsyslog
3) – rsyslog via UDP port 514 send the log to the remote rsyslog server
4) – remote rsyslog server receives the log and depending on type dispatches it to proper log files

Configuration:
/etc/apache2/conf.d/myvhost.de.conf
ErrorLog |/etc/apache2/err2syslog.sh
CustomLog |/etc/apache2/acc2syslog.sh combined
Scripts:
Script used to receive the access log line and send it to rsyslog(local1):
/etc/apache2/acc2syslog.sh
#!/bin/bash
# Send to rsyslog as local1 any message that is sent to STDIN
# eg: > echo "This is my first log message" | acc2syslog.sh
read Message
logger -p local1.notice -t "Apache2 ACCESS" $Message
Script used to receive the error log line and send it to rsyslog(local0):
/etc/apache2/err2syslog.sh
#!/bin/bash
# Send to rsyslog as local0 any message that is sent to STDIN
# eg: > echo "This is my first log message" | err2syslog.sh
read Message
logger -p local0.err -t "Apache2 ERROR" $Message
/etc/rsyslog.conf
(rsyslog configuration-Where Apache runs)
local0.* @syslog-server.com
local1.* @syslog-server.com
/etc/rsyslog.conf
(receiver rsyslog configuration)
Example:# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
$AllowedSender UDP, 127.0.0.1, 192.168.10.0/24

EXTRA:
Useful PERL script to use as replacement to any above scripts.
#!/usr/bin/perl
use Sys::Syslog qw( :DEFAULT setlogsock );
#
setlogsock('unix');
openlog('apache', 'cons', 'pid', 'local0');
#
while ($log = ) {
syslog('notice', $log);
}
closelog

IMPORTANT NOTE: You have to be careful with this way of remotely logging Apache logs. The danger is (and I had it happened to me) that if the receiving log server is not ready to receive the logs for whatever reason, the opened files count will rise in the sending machine until the limit of possible open files (set at the kernel level) is reached, in which case the systems goes to its knees …. bad news :-).