Apache Log Cutting

For the site to be built, access to the word will have access to the log.

For the discuz Forum We are building , there will be a log of access to this forum.

[Email protected] ~]# vim/usr/local/apache2/conf/extra/httpd-vhosts.conf

Find the following:

Errorlog "Logs/dummy-host.example.com-error_log"

Customlog "Logs/dummy-host.example.com-access_log" common

Errorlog is the error log, andcustomlog is the access log.

Customlog is Apache 's access log.

Customlog "Logs/dummy-host.example.com-access_log" common

Common represents the type of log, first name.

The path to the log is a relative path under /usr/local./apache2/logs .

Modify to the following content:

Errorlog "Logs/test.com-error_log" Customlog "Logs/test.com-access_log" combined

:Wq

Log type modified to combined

[Email protected] ~]# apachectl-t

Syntax OK

[Email protected] ~]# Apachectl Graceful

After re-loading apache , refresh several pages, now let's look at the access log.

[Email protected] ~]# Tail/usr/local/apache2/logs/test.com-access_log

Can see a lot of access information, we take one of them as an example, look at the meaning of each paragraph.

#192.168.179.1--[17/nov/2015:19:11:43 +0800] "get/forum.php

Mod=ajax&action=forumchecknew&fid=2&time=1447758300&inajax=yes HTTP/1.1 "+"/http www.clnice.com/forum.php?mod=forumdisplay&fid=2 "" mozilla/5.0 (Windows NT 6.2; WOW64) applewebkit/537.36 (khtml, like Gecko) chrome/44.0.2403.157 ubrowser/5.5.6743.204 safari/537.36 "

The following content is found in the Apache configuration file, which corresponds to one by one of the above access logs.

[Email protected] ~]# vim/usr/local/apache2/conf/httpd.conf

Logformat "%h%l%u%t \"%r\ "%>s%b \"%{referer}i\ "\"%{user-agent}i\ "" combined

%h is the source IP , which is the client IP,%l and %u are not present, so use--Express, %u is the user ,

%t time,\ "%r\" is the action, the action here is GET.

\ " %{referer}i\ "refers to where it jumps from.   For example, one of the Web addresses you visited is   This page has a URL HTTP://234.COM/2.HTML  you directly point this link into the   234.COM/2.HTML  2.HTML  its referer is   HTTP://123.COM/1.HTML 

"%{user-agent}i\" is the browser's logo, you can use the logo to restrict some access, such as the use of Curl Access We can go to make a limit, let it visit time to show 403.

%>s can be used to record the final state of a request .

The log will take up a lot of disk space if you don't manage it more and more. We need to do a log cut, and then clear the old access log every once in a while.

Log cutting:

[Email protected] ~]# vim/usr/local/apache2/conf/extra/httpd-vhosts.conf

Found it

Errorlog "Logs/test.com-error_log"

Customlog "Logs/test.com-access_log" combined

Modified to:

Customlog "|/usr/local/apache2/bin/rotatelogs-l/usr/local/apache2/logs/cest.com-access_%y%m%d_log 86400" combined

|/usr/local/apache2/bin/rotatelogs-l : Cutting tool.

/usr/local/apache2/logs/clnice.com-access_log_%y%m%d_log 86400

Use an absolute path to prevent the cutting tool from finding this log.

%y%m%d plus time stamp, four-bit year, two-bit month, two-bit day

86400 is the second equivalent of one day , cut at intervals of a day.

The error log is relatively small, and you can not set up log splitting.

Save the virtual profile, reload Apache , refresh a few discuz Forum pages, and then look at the log files in the logs directory. You can see The log files in this format, Test.com-access_20160323_log.

[Email protected] logs]# apachectl-t

Syntax OK

[Email protected] logs]# Apachectl Graceful

[[email protected] logs]# ls

Access_log Httpd.pid Test.com-access_log

Error_log Test.com-access_20160323_log Test.com-error_log

Apache Log Cutting issues

Apache logs can be automatically cut.

Method One: Use cronolog to create a new log for each day

Customlog "|bin/cronolog Logs/access_%y%m%d.log" combined

You can also press the hour

Customlog "|bin/cronolog Logs/access_%y%m%d%h.log" combined

Method Two: Use rotatelogs to record a log every day

Customlog "|bin/rotatelogs-l logs/access_%y%m%d.log 86400" combined

Per hour

Customlog "|bin/rotatelogs-l Logs/access_%y%m%d%h.log 3600" combined

See Apache rotatelogs Grammar again

Rotatelogs [-l] logfile [rotationtime [offset]] | [Filesizem]

Options

-L

Use local time instead of GMT time as the time base. Note: Use- l in an environment that alters the GMT offset (such as daylight saving time) Can lead to unpredictable results. So be sure to add - l Otherwise, the log time and the actual time is 8 hours difference.

LogFile

It adds the base name to the log file name. If logfile contains "%", it will be treated as a format string for strftime () , otherwise it will be automatically added in seconds. . nnnnnnnnnn"suffix. Both formats represent the time when the new log began to be used.

Rotationtime

The interval of time in seconds that the log file is scrolled.

Offset

The number of minutes of the time difference relative to UTC . If omitted, it is assumed to be "0″ and uses UTC time." For example, to specify local time for a region with a UTC difference of "-5 hours", this parameter should be "-300″."

Filesizem

Specifies that scrolling is filesizem file size instead of scrolling by time or slack.

Apache Log Cutting