Linux: Apache logs

Location

The Apache Web Server log files contains all errors found while serving requests as well as records of all incoming requests. The location of the log files is configurable. By default they are stored in one of these directories depending on the Linux distribution:

  • /var/log/httpd
  • /var/log/apache2
  • sometimes directly in /var/log
  • /usr/local/apache/log

The exact location of the log files is configured in the apache2.conf or httpd.conf log file. Here’s where you should look for it:

  • /etc/apache2/httpd.conf
  • /usr/local/etc/apache2/httpd.conf
  • /etc/httpd/conf/httpd.conf

To find the location of the error log file, open the apache configuration file and search for ErrorLog. Alternatively you can use grep to get the information without having to open the file in an editor:

# grep ^ErrorLog /etc/apache2/httpd.conf
ErrorLog /var/log/apache2/error_log

Replace /etc/apache2/httpd.conf by the actual location of the apache configuration file.

The access log file containing the records of all incoming requests, is usually stored at the same location. To get its name, you usually just have to replace error by access in the path to the error log file.

You can also get the actual location of the access log file using grep:

# grep ^CustomLog /etc/apache2/httpd.conf
CustomLog /var/log/apache2/access_log combined

Format

The “combined” after the log file path means that the “combined” log format should be used. The other log format you can use is the “common” log format. Both of them are pretty similar. The common log format will store the following information on each line:

  • IP address of the client
  • identity of the client
  • user ID
  • time that the server finished processing the request
  • method used (e.g. GET) and requested resource
  • status code sent back to the client
  • size of the object returned to the client

Additionally, the combined log format will also store the following information:

  • site the client has been referred from
  • User-Agent

Graceful restart

A graceful restart will instruct the web server to reopen the log files for new requests. When you rename the log files, apache will continue writing to the renamed log files. By performing a graceful restart of apache, you will cause apache to reopen the log files at the configured path and write to the new files for new requests. Requests being processed at the time of the graceful restart will be logged to the renamed file. So after a graceful restart, you will need wait for all pending requests to be finally processed before you can work on the renamed logfiles (e.g. compress them).

Here a short example:

mv /var/log/apache2/access_log /var/log/apache2/access_log.save
mv /var/log/apache2/error_log /var/log/apache2/error_log.save
/usr/sbin/apache2ctl -k graceful

The pending requests will be logged to access_log.save and error_log.save and new requests to access_log and error_log.

Note that instead of /usr/sbin/apache2ctl you might have to use one of the following:

  • /usr/sbin/apachectl
  • /usr/sbin/httpd2
  • /usr/local/apache2/bin/apachectl

Also if it complains that the arguments are not fine try executing it without the -k i.e. only with graceful as command line argument.

Log rotation

Using a graceful restart, you can manually rotate logs (or rotate them with a cron job) but there’s an even nicer solution. You can used piped logs. Piped logs just mean that the web server will write log files through a pipe to another process instead of directly to the files. Like this you can basically redirect the log files to rotatelogs which will create new log files on a regular basis.

Instead of:

CustomLog /var/log/apache2/access_log combined

configure the following:

CustomLog "|/usr/sbin/rotatelogs2 /var/log/apache2/access_log 86400" combined

86400 is the number of seconds after which the log file should be rotated (in this case 24 hours).

Instead of /usr/sbin/rotatelogs2 you might have to use one of the following paths:

  • /usr/sbin/rotatelogs
  • /usr/local/apache/bin/rotatelogs
  • /usr/local/sbin/rotatelog

Other log files

There are also other log files created by the apache log server or its modules. They are usually stored in the same location as the error and access logs. Some of them are:

  • ScriptLog: log for mod_rewrite, input to and output from CGI scripts
  • RewriteLog: log for mod_rewrite, rewrite transforms requests
  • JkLogFile : log for mod_jk, communication between Tomcat and Apache

Leave a Reply

Your email address will not be published. Required fields are marked *