I'm investigating centralised logging and it seems there's so many different ways this can be done.

I don't want to run logstash as a log "sender", preferring to keep the web servers as lean and simple possible. So that means either using syslog, syslog-ng or the one I'm testing now, rsyslog.

But I would like to have separate vhost log files on the web server, in addition to these logs being sent to a remote log collector.
I've tested rsyslog using the imfile module to watch the Apache log files, but this means I have to hard-code each vhost log file into my rsyslog.conf. Not ideal as people will invariably forget when they add/remove sites on the server.
The reason I'm using rsyslog's imfile is that Apache doesn't appear to let you log to file and syslog.
And I want to keep vhost-specific log files on the web server.

So how can I do this?
Is there a way of having rsyslog produce local log files and forward the logs to a remote collector?

I am prepared to change my Apache config to log to a single access/error log for all vhosts, so long as there are vhost-specific log files produced somewhere on the web server machine.
I just don't want to lose any logging info if the remote log collector can't be contacted for any reason.

Any comments/suggestions?

Cheers, B