By design Drupal 6.x sites will log all activity to the database using a core feature called watchdog. Not having to require users to configure permissions for a log file on the server reduces install instructions (and possible errors) and creates a more seamless experience for Drupal users and administrators. Unfortunately, this makes monitoring a large multisite installs more laborious.

Enter Syslog.

Syslog is a local and network logging service that has been around since the 1980s. Most *nix systems come preloaded with Syslog and fortunately for us Drupal has a Syslog module included with the 6.x and 7.x cores. Here’s how to set it up:

1) Install & configure the Syslog module

Go to your module install page, /admin/build/modules and install the Syslog module. Then go to the Syslog settings page, /admin/settings/logging/syslog, and select which Syslog level to attach to the log messages. Choose one that is not in use by Syslog

2) Configure Syslog

Edit /etc/syslog.conf and add:

local0.* /var/log/drupal.log

Then, restart Syslog

3) Disable Watchdog database logging

This will require us to edit the Drupal core (oh noes)
Edit drupal/modules/dblog/dblog.module and comment out the contents of dblog_watchdog() (Around line 132)

Original:

function dblog_watchdog($log = array()) {
  $current_db = db_set_active();
  db_query("INSERT INTO {watchdog}
    (uid, type, message, variables, severity, link, location, referer, hostname, timestamp)
    VALUES
    (%d, '%s', '%s', '%s', %d, '%s', '%s', '%s', '%s', %d)",
    $log['user']->uid,
    $log['type'],
    $log['message'],
    serialize($log['variables']),
    $log['severity'],
    $log['link'],
    $log['request_uri'],
    $log['referer'],
    $log['ip'],
    $log['timestamp']);
 
  if ($current_db) {
    db_set_active($current_db);
  }
}

Change to:

function dblog_watchdog($log = array()) {
/*
  $current_db = db_set_active();
  db_query("INSERT INTO {watchdog}
    (uid, type, message, variables, severity, link, location, referer, hostname, timestamp)
    VALUES
    (%d, '%s', '%s', '%s', %d, '%s', '%s', '%s', '%s', %d)",
    $log['user']->uid,
    $log['type'],
    $log['message'],
    serialize($log['variables']),
    $log['severity'],
    $log['link'],
    $log['request_uri'],
    $log['referer'],
    $log['ip'],
    $log['timestamp']);
 
  if ($current_db) {
    db_set_active($current_db);
  }
*/
}

And you’re done.