Dynamic Error and Custom logs in apache 2 using wildcard subdomains

At the risk of giving you more work, you may also want to consider going the opposite direction and combining ALL of your logfiles into syslog. It seems more intimidating but it's a much more capable solution. I don't bother with separate logs anymore at all and just pipe all logs directly to the syslog (which keeps everything in /var/log/messages).

Though Apache doesn't do it natively, you can achieve it like so...

LogLevel info
ErrorLog  "| /usr/bin/logger -thttpd -plocal6.err"
CustomLog "| /usr/bin/logger -thttpd -plocal6.notice" "%v %h %l %u %t \"%r\" %>s %b"

Syslog will give you a lot of options as there are tons of services and utilities set up to parse and manage it. I love using lnav personally, you can filter, sort, search, etc. and the interface over ssh is colourized so it's easy to spot problems. You can also use utilities to deliver all of this into a SQL db where the sky's the limit, or for less work you can use commercial services like datadog that have pretty dashboards :).

You'll want to read up on things like facilities (local1-7) which allow you to assign groups basically to services that don't have syslog logging built in.

In the definition above, I'm piping both my access and error logs to logger which is a utility designed to accept logs and record them in a common format in the syslog along with the details of the service providing them. You can see that the %v is the first part of my access log which makes it easy to filter for vhosts in the syslog down the road.

You'll notice in the directives, that the error log uses local6.err while the access log uses local6.notice, this actually sets the level of the log line, the errors will end up coloured red in lnav, while the others will be standard/info.

Beware the rabit hole ;)