Apache Log Cutting

[Email protected] ~]# vim/usr/local/apache2/conf/extra/httpd-vhosts.conf

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M00/79/0B/wKiom1aFRH6w3lq9AAA06EYUr9E441.png "title=" Qq20151231231320.png "alt=" Wkiom1afrh6w3lq9aaa06eyur9e441.png "/>common represents the type name of the access log, we look at a configuration file, in the main profile we can see the format of the log, Name lookup/common650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M01/79/09/wKioL1aFRYahPobIAABAAfpV9fk109.png " Title= "2.png" alt= "Wkiol1afryahpobiaabaafpv9fk109.png"/>

Preferably in combined format, we can also customize one, just like

Logformat "%h%l%u%t \"%r\ "%>s%b \"%{referer}i\ "\"%{user-agent}i\ "%I%O" Combinedio

We now access the log in combined format: Customlog "Logs/test.com-access_log" combined

Where the log is written, you can put it under logs, this logs is relative, relative to the Apache directory.

[Email protected] logs]# cd/usr/local/apache2/logs/

Access_log Error_log Httpd.pid

If the two logs are opened, they will be generated in this directory, generating these two files

[[email protected] logs]# ls

Access_log error_log httpd.pid Test.com-access_log test.com-error_log

[email protected] logs]# cat Test.com-access_log

192.168.140.2--[30/dec/2015:23:16:12 +0800] "get/http/1.1" 301-"http://www.test.com/forum.php" "mozilla/5.0 (Window S NT 6.1) applewebkit/537.36 (khtml, like Gecko) chrome/47.0.2526.106 safari/537.36 "

192.168.140.2 is its source IP, in contrast to our format%h This is the source IP

--just%l%u these two are not exist, so use "_" to replace the%u is the user, for example, we go to visit ABC, we are not to access the USR1 user, and then enter the password abc/12.txt, you can tail see

[[email protected] logs] #tail Test.com-access_log

92.168.140.2-user1 [30/dec/2015:23:17:01 +0800] "Get/abc/12.txt http/1.1" 304-"-" "mozilla/5.0 (Windows NT 6.1) Apple webkit/537.36 (khtml, like Gecko) chrome/47.0.2526.106 safari/537.36 "

-User1 is not here User1 Ah, this is our user%u users, that is the specific things we can find in Apache's official website document the corresponding meaning

%t: Time [30/dec/2015:23:17:01 +0800]

%r: Is the action "GET" or "POST"

This is referer, what is called Referer, that is, when you visit this address where it came from: "http://www.test.com/forum.php" referer behind is his user agent is the browser's table knowledge " mozilla/5.0 (Windows NT 6.1) applewebkit/537.36 (khtml, like Gecko) chrome/47.0.2526.106 safari/537.36 ", such as line our Google browser Chrome Internet Explorer or our curl.

192.168.140.100--[30/dec/2015:22:53:33 +0800] "HEAD http://www.test.com/HTTP/1.1" 301-"-" "curl/7.19.7 (i386-redhat- LINUX-GNU) libcurl/7.19.7 nss/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2 "

Browser is not the same, the identity of the access is not the same, that is to say that the user agent is very useful, we can use it to restrict some IP, as long as the user agent curl I can make it 403,

So many access records. We should do an archive, every day to do a cut, today with today's date renamed, tomorrow can be renamed with tomorrow's date, and then a log of a log to do it well cut, and then after one months our old log useless, we have to remove it, in order to prevent our disk to unlimited growth, How do you cut it?

[Email protected] logs]# vim/usr/local/apache2/conf/extra/httpd-vhosts.conf

The method is very simple, with a tool, the first is "|" The meaning of the pipe character, we use this tool

Customlog "|/usr/local/apache2/bin/rotatelogs-l/usr/local/apache2/logs/test.com-access_%y%m%d_log 86400" combined

Where we keep the logs, we use absolute paths/usr/local/apache2/logs

The purpose of absolute path is to prevent this log can not be found, then its log format need to add a timestamp, this is similar to the date that the command, this log is divided by the day 86,400 seconds is a day errorlog also in this format to do cutting, but after all, errorlog is less, So we don't have to do cutting, we only cut access logs

#apchectl-T

#syntax OK

#apachectl restart

[[email protected] logs]# ls

Access_log error_log httpd.pid test.com-access_20151230_log test.com-access_20151231_log test.com-access_log test.co M-error_log

December 30, 2015 This is cut by the day, then change the period

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/79/0A/wKioL1aFUhWibmBgAAA1FHcJXm4519.png "title=" 3.png " alt= "Wkiol1afuhwibmbgaaa1fhcjxm4519.png"/>

This article is from the "Dream On the Ridge" blog, be sure to keep this source http://mengjunlinux.blog.51cto.com/10772888/1730589

Apache Log Cutting