Apache Log Polling configuration detailed

ApacheDetailed log Polling configuration

1,ApacheLog Polling function

as the server continues to run, the log files will become larger and bigger, if you accidentally put the log file into a location such as/Var, the log file may be full partition, resulting in the server forced to stop running. This kind of thing has really happened before. To prevent this problem, you can move the log files to a location that has sufficient space before they become too large. This can be done in several ways. Some Unix variants provide a logrotate script that can help us accomplish this task. For example , RedHat is pre-configured, it will rotate the log file every time depending on the size of the log file or the log file, so that a single log file is not too large for easy storage, viewing, and analysis.

2. Write log records to the specified program

logging is not only written to a file, it can also be written to the specified process. This is useful when we want to write log information to a database, or some program that can display the traffic statistics of a website in real time. to implement this function you can use the Transferlog or customlog instructions, we can specify the "|" , followed by the name of the program that received the log information. For example:

Customlog | /usr/bin/apachelog.pl Common

which/usr/bin/apachelog.plis a program that this program knows how to handleApachelog file records. In fact, this program is very simple, for example, it can be a way of handling log records in aPerlprogram, or a program that writes log records to the database. when using this method of logging data, security is the most important issue to pay attention to. Log files are opened with the privileges of the user who started the server, usuallyRoot. This is also true for programs that write log records to the database, so ensure that the program used to log data is adequately secured.
If the log data is logged through an unsafe program (this program may be non-Rootuser intrusion and modification), the system is at risk of being replaced by other malicious programs by the logger. For example, if/usr/bin/apachelog.plcan be modified by users all over the world, then any user will be able to edit this file offWebserver, send the password file to a mailbox, or delete some important files becauseRootThe user has permission to do all of these actions.
If you want to write log records to a program, it is recommended to find out if there is a ready-made module with the features you want. Please visithttp://modules.apache.org/, the site collects a number ofApachemodules that complete a variety of practical tasks.

3. Log of multiple virtual hosts 

when multiple virtual hosts are running on the same machine, the log records of all the virtual hosts are saved to the same machine, and then the log files are divided into multiple parts according to the different virtual host computers. the complete solution to this problem is not to write all of the virtual host's log records to the same file at the outset. While I know that there are tools that do exist, they are able to separate the log records of multiple virtual hosts from the virtual host configuration, indicate which requests are being issued for which virtual host, and then generate the reports separately. However, this approach seems to be too troublesome.
when we specify log files for each virtual host, we only need to The VirtualHost zone specifies the log file for this host. Thereafter, when we need to make a report, we can process each log file separately.
However, it is important to note that there is a problem with the available file handles. That is, if there are up to hundreds of virtual hosts running on one server, and each virtual host has a separate log file, there may be an issue with insufficient file handles available, which can cause system instability or even crash the system. However, only when the number of virtual hosts running on the server is very large is it necessary for us to pay attention to this issue.

4,ApacheLog Polling technology implementation(1) First download the installationApacheThe log Polling toolCronolog

[email protected] ~]# yum-y install gcc gcc-c++

[Email protected] ~]# wget https://files.cnblogs.com/files/crazyzero/cronolog-1.6.2.tar.gz

[Email protected] ~]# tar zxvf cronolog-1.6.2.tar.gz

[Email protected] ~]# CD cronolog-1.6.2

[Email protected] ~]# mkdir-p/usr/local/cronolog

[Email protected] cronolog-1.6.2]#/configure--prefix=/usr/local/cronolog

[[email protected] cronolog-1.6.2]# make && make install

(2)CronologLog Polling configuration instructions

If there is no virtual host, configuration log polling needs to be modified Apache master configuration file httpd.conf

If you configure a virtual host, you need to modify the configuration file httpd-vhosts.conf

Polling by day (common usage in production environment, recommended)

Customlog "|/usr/local/cronolog/sbin/cronolog Logs/access_www_%y%m%d.log" combined

errorlog "|/usr/local/cronolog/sbin/cronolog Logs/error_www_%y%m%d.log"

( hint: Cronolog polling log correctly, the log path to be polled is to write the full path (log by day, log is not automatically overwritten))

Poll by hour (common usage in production environment)

Customlog "|/usr/local/cronolog/sbin/cronolog Logs/access_www_%y%m%d%h.log" combined

errorlog "|/usr/local/cronolog/sbin/cronolog Logs/error_www_%y%m%d%h.log"

( Hint: This configuration may be appropriate if you need to analyze Apache logs in a timely and detailed manner.)

Poll by Minute

Customlog "|/usr/local/cronolog/sbin/cronolog Logs/access_www_%y%m%d%h%m.log" combined

errorlog "|/usr/local/cronolog/sbin/cronolog logs/error_www_%y%m%d%h%m. Log"

Weekly Polling (a common method for production environments)

Customlog "|/usr/local/cronolog/sbin/cronolog Logs/access_www_%w.log" combined

Errorlog "|/usr/local/cronolog/sbin/cronolog logs/error_www_%w.log"

Virtual Host Configuration Polling method

<virtualhost *:80>

ServerAdmin [email protected]

DocumentRoot "/var/html/blog"

ServerName www.blog.com

Errorlog "|/usr/local/cronolog/sbin/cronolog logs/error_www_%y%m%d. Log"

Customlog "|/usr/local/cronolog/sbin/cronolog Logs/access_www_%y%m%d.log" combined

</VirtualHost>

Apache Log Polling configuration detailed