Apache Log configuration detailed (Rotatelogs Logformat)

Logs/error_log
Customlog Logs/access_log Common
--The default is that the above section is modified as follows:

Errorlog "|/usr/sbin/rotatelogs/var/log/httpd/10.70.25.143:10002.errorlog.%y%m%d%h 7200 480"
Customlog "|/usr/sbin/rotatelogs/var/log/httpd/10.70.25.143:10002.accesslog.%y%m%d%h 7200 480" common

Comments:
Apache provides the ability to send logs directly to another program, rather than writing them to a file. This greatly enhances the ability to process logs. The program can be any program, such as log analysis, compression log and so on. To implement an operation that writes logs to a pipeline, simply replace the contents of the log file portion of the configuration with the "| Program name", for example:
# Compressed logs

$ customlog "|/usr/bin/gzip-c >>/var/log/access_log.gz" common

Use the Apache-based round-robin tool Rotatelogs to cycle through the log files. Rotatelogs basically the log is controlled by time or size.
Use time to control log files, for example:
Customlog "|/usr/sbin/rotatelogs/var/log/httpd/10.70.25.143:10002.accesslog.%y%m%d%h 7200 480" Common with file size control log file, For example:
Customlog "|/usr/sbin/rotatelogs/var/log/httpd/10.70.25.143:10002.accesslog.%y%m%d%h 5M" common

Here the 7200 units are seconds (7200S=2H) that is, two hours to cycle through the log, regenerate a log file. and the format of the generated file is
10.70.25.143:10002.ERRORLOG.%Y%M%D%H (Specific parameters can be arbitrarily set, see the following format manual) if not set will be automatically added in seconds of the ". nnnnnnnnnn" suffix.

480 is the time difference, the file is in the United States time, China's jet lag is 8 hours more than the United States is 480 minutes, so add 480 minutes

Where common is the name set in the log record format.
If you have more than one site, you should write the above configuration to the VirtualHost node in each site, so that each site log is recorded separately.

5M is a file size limit

Grammar:
Rotatelogs [-l] logfile [rotationtime [offset]] | [Filesizem]

Options:
-L

Use local time instead of GMT time as the time base. Note: using-l in an environment that alters the GMT offset, such as daylight saving time, can cause unpredictable results.
LogFile
It adds the base name to the log file name. If logfile contains "%", it is treated as a format string for strftime (), otherwise it is automatically appended with the ". nnnnnnnnnn" suffix in seconds. Both formats represent the time when the new log began to be used.
Rotationtime
The interval of time in seconds that the log file is scrolled.
Offset
The number of minutes of the time difference relative to UTC. If omitted, it is assumed to be "0" and UTC time is used. For example, to specify local time for a region with a UTC difference of "-5 hours", this parameter should be "300".
Filesizem
Specifies that scrolling is filesizem file size instead of scrolling by time or slack.

The following log file format strings can be supported for all strftime (3) implementations, as shown in the Strftime (3) manual for the various extension libraries:
%A full name of the week (local)

%a 3-character weekday name (local)
%B the full name of the month name (local)
%b a 3-character month name (local)
%c Date and time (local)
%d 2-digit number of days in one months
%H 2-digit hours (24-hour system)
%I 2-digit hours (12-hour system)
%j 3-digit number of days in a year
%M 2-digit number of minutes
%m 2-digit number of months
%p AM/PM12 hours of the afternoon (local)
%s 2-digit number of seconds
%u 2-digit number of weeks in the year (Sunday is the first day of the week)
%W 2-digit number of weeks in the year (Monday is the first day of the week)
%w 1-digit days of the week (Sunday is the first day of the week)
%x time (local)
%x Date (local)
%Y 4-digit year
%y 2-digit year
%Z Time Zone name
Percent sign "%" itself

Other

Log format settings:
Default settings:
Logformat "%h%l%u%t \"%r\ "%>s%b \"%{referer}i\ "\"%{user-agent}i\ "" combined
Logformat "%h%l%u%t \"%r\ "%>s%b" common
Logformat "%{referer}i,%u" Referer
Logformat "%{user-agent}i" Agent

Detailed: (from the network below)
Settings for Apache logging format

The format of the custom log file involves two instructions, the Logformat directive and the Customlog directive, and the default httpd.conf file provides several examples of these two instructions.

The LOGFORMAT directive defines the format and assigns a name to the format, and we can refer to that name directly later. The customlog instruction sets the log file and indicates the format in which the log file is used (usually by the name of the format).

The function of the Logformat directive is to define the log format and assign it a name. For example, in the default httpd.conf file, we can find the following line of code:

Logformat "%h%l%u%t \"%r\ "%>s%b" common
This directive creates a log format called "Common", which is specified in the text surrounded by double quotes. Each variable in the format string represents a specific piece of information that is written to the log file in the order specified by the format sequence.

The Apache documentation has given you all the variables that are available for the format string and their meanings, as follows:
%...A: Remote IP Address
%... A: Local IP address
%... B: Number of bytes sent, not including HTTP headers
The number of bytes sent in the%...B:CLF format, with no HTTP headers. For example, when no data is sent, write '-' instead of 0.
%... {foobar}e: Contents of environment variable FOOBAR
%...F: File name
%...H: Remote Host
%... H the requested protocol
%... {Foobar}i:foobar content, the header line of the request sent to the server.
%...L: Telnet name (from Identd, if provided)
%...m method of Request
%... {foobar}n: The contents of the annotation "Foobar" from another module
%... {Foobar}o:foobar content, header line of the reply
%...P: The port used by the server in response to a request
%... P: The child process ID of the response request.
%...Q query string (if there is a query string, contains "?" The following part; otherwise, it is an empty string. ）
%...R: First line of the request
%...S: status. For internal redirection requests, this refers to the status of the original * request. If you use%...>s, you refer to a later request.
%...T: Time in Public log time format (or Standard English format)
%... {format}t: The time represented in the specified format
%... T: The amount of time spent in response to a request, in seconds
%...U: Remote user (from Auth; if the return status (%s) is 401 it may be forged)
%... U: URL path requested by the user
%...V: servername of the server responding to the request
%... V: Server name according to Usecanonicalname settings

In all the variables listed above, "..." represents an optional condition. If no condition is specified, the value of the variable is replaced with "-". Analyzing the example of the logformat instruction from the default httpd.conf file earlier, you can see that it creates a log format called "Common", which includes: remote host, Telnet name, remote user, request time, first line of request, request status, and number of bytes sent.

Sometimes we just want to record some specific, defined information in the log, and then we need to use "...". If you put one or more HTTP status codes between "%" and a variable, the content represented by the variable is logged only if the status code returned by the request belongs to one of the specified status codes. For example, if we want to record all the invalid links for a site, you can use:
Logformat%404{referer}i Brokenlinks

Conversely, if we want to record the request that the status code does not equal the specified value, simply add a "!" Symbols can:

Logformat%!200u Somethingwrong

Specifically documenting a spider record.

Setenvifnocase user-agent Baiduspider Baidu_robot
Logformat "%h%t \"%r\ "%>s%b" robot
Linux under
Customlog "|/usr/local/apache2.2.0/bin/rotatelogs/usr/local/apache2.2.0/logs/baidu_%y%m%d.txt 86400 480″robot env= Baidu_robot
Windows under
Customlog "|bin/rotatelogs.exe logs/baidu_%y%m%d.txt 86400 480″robot Env=baidu_robot
In this case, in the logs directory, will be generated every day, Baidu_ day. txt log, each record and the following similar:
61.135.168.14 [22/oct/2008:22:21:26 +0800] "get/http/1.1″200 8427

Remove pictures, JS, CSS, swf files from the log

<filesmatch "\. (ICO|GIF|JPG|PNG|BMP|SWF|CSS|JS) ">
SETENV IMAG 1
</FilesMatch>
Customlog "|bin/cronolog.exe logs/cpseadmin/access_%y%m%d.log" combined env=! IMAG

Herb Recommended for you:

• Linux Server security policy detailed Apache configuration
• Awstats Installation Configuration Documentation
• Load Balancer Cluster--nginx
• Iptables-To-digest (1 principle)
• Nginx 0.8.x + PHP 5.2.13 (FastCGI)
• centos5.4 Apache Integrated Tomcat configuration detailed
• Apache server configuration and Management under Linux (CentOS)
• Linux Knowledge essentials
• Distributed File System MFS (MOOSEFS) for storage sharing
• Nagios installation deployment and integration with cacti

Apache Log configuration detailed (Rotatelogs Logformat)