github.com/krum110487/go-htaccess@v0.0.0-20240316004156-60641c8e7598/tests/data/apache_2_2_34/manual/logs.html.en (about)

     1  <?xml version="1.0" encoding="ISO-8859-1"?>
     2  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
     3  <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
     4  <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
     5  <!--
     6          XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
     7                This file is generated from xml source: DO NOT EDIT
     8          XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
     9        -->
    10  <title>Log Files - Apache HTTP Server Version 2.2</title>
    11  <link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
    12  <link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
    13  <link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
    14  <script src="./style/scripts/prettify.min.js" type="text/javascript">
    15  </script>
    16  
    17  <link href="./images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/logs.html" rel="canonical" /></head>
    18  <body id="manual-page"><div id="page-header">
    19  <p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p>
    20  <p class="apache">Apache HTTP Server Version 2.2</p>
    21  <img alt="" src="./images/feather.gif" /></div>
    22  <div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
    23  <div id="path">
    24  <a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.2</a></div><div id="page-content"><div class="retired"><h4>Please note</h4>
    25              <p> This document refers to a legacy release (<strong>2.2</strong>) of Apache httpd. The active release (<strong>2.4</strong>) is documented <a href="http://httpd.apache.org/docs/current">here</a>. If you have not already upgraded, please follow <a href="http://httpd.apache.org/docs/current/upgrading.html">this link</a> for more information.</p>
    26          <p>You may follow <a href="http://httpd.apache.org/docs/current/logs.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>Log Files</h1>
    27  <div class="toplang">
    28  <p><span>Available Languages: </span><a href="./en/logs.html" title="English">&nbsp;en&nbsp;</a> |
    29  <a href="./fr/logs.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
    30  <a href="./ja/logs.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
    31  <a href="./ko/logs.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
    32  <a href="./tr/logs.html" hreflang="tr" rel="alternate" title="Türkçe">&nbsp;tr&nbsp;</a></p>
    33  </div>
    34  
    35      <p>In order to effectively manage a web server, it is necessary
    36      to get feedback about the activity and performance of the
    37      server as well as any problems that may be occurring. The Apache
    38      HTTP Server provides very comprehensive and flexible logging
    39      capabilities. This document describes how to configure its
    40      logging capabilities, and how to understand what the logs
    41      contain.</p>
    42    </div>
    43  <div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#security">Security Warning</a></li>
    44  <li><img alt="" src="./images/down.gif" /> <a href="#errorlog">Error Log</a></li>
    45  <li><img alt="" src="./images/down.gif" /> <a href="#accesslog">Access Log</a></li>
    46  <li><img alt="" src="./images/down.gif" /> <a href="#rotation">Log Rotation</a></li>
    47  <li><img alt="" src="./images/down.gif" /> <a href="#piped">Piped Logs</a></li>
    48  <li><img alt="" src="./images/down.gif" /> <a href="#virtualhost">Virtual Hosts</a></li>
    49  <li><img alt="" src="./images/down.gif" /> <a href="#other">Other Log Files</a></li>
    50  </ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
    51  <div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
    52  <div class="section">
    53  <h2><a name="security" id="security">Security Warning</a></h2>
    54      
    55  
    56      <p>Anyone who can write to the directory where Apache is
    57      writing a log file can almost certainly gain access to the uid
    58      that the server is started as, which is normally root. Do
    59      <em>NOT</em> give people write access to the directory the logs
    60      are stored in without being aware of the consequences; see the
    61      <a href="misc/security_tips.html">security tips</a> document
    62      for details.</p>
    63  
    64      <p>In addition, log files may contain information supplied
    65      directly by the client, without escaping. Therefore, it is
    66      possible for malicious clients to insert control-characters in
    67      the log files, so care must be taken in dealing with raw
    68      logs.</p>
    69    </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
    70  <div class="section">
    71  <h2><a name="errorlog" id="errorlog">Error Log</a></h2>
    72      
    73  
    74      <table class="related"><tr><th>Related Modules</th><th>Related Directives</th></tr><tr><td /><td><ul><li><code class="directive"><a href="./mod/core.html#errorlog">ErrorLog</a></code></li><li><code class="directive"><a href="./mod/core.html#loglevel">LogLevel</a></code></li></ul></td></tr></table>
    75  
    76      <p>The server error log, whose name and location is set by the
    77      <code class="directive"><a href="./mod/core.html#errorlog">ErrorLog</a></code> directive, is the
    78      most important log file. This is the place where Apache httpd
    79      will send diagnostic information and record any errors that it
    80      encounters in processing requests. It is the first place to
    81      look when a problem occurs with starting the server or with the
    82      operation of the server, since it will often contain details of
    83      what went wrong and how to fix it.</p>
    84  
    85      <p>The error log is usually written to a file (typically
    86      <code>error_log</code> on Unix systems and
    87      <code>error.log</code> on Windows and OS/2). On Unix systems it
    88      is also possible to have the server send errors to
    89      <code>syslog</code> or <a href="#piped">pipe them to a
    90      program</a>.</p>
    91  
    92      <p>The format of the error log is relatively free-form and
    93      descriptive. But there is certain information that is contained
    94      in most error log entries. For example, here is a typical
    95      message.</p>
    96  
    97      <div class="example"><p><code>
    98        [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1]
    99        client denied by server configuration:
   100        /export/home/live/ap/htdocs/test
   101      </code></p></div>
   102  
   103      <p>The first item in the log entry is the date and time of the
   104      message. The second item lists the severity of the error being
   105      reported. The <code class="directive"><a href="./mod/core.html#loglevel">LogLevel</a></code>
   106      directive is used to control the types of errors that are sent
   107      to the error log by restricting the severity level. The third
   108      item gives the IP address of the client that generated the
   109      error. Beyond that is the message itself, which in this case
   110      indicates that the server has been configured to deny the
   111      client access. The server reports the file-system path (as
   112      opposed to the web path) of the requested document.</p>
   113  
   114      <p>A very wide variety of different messages can appear in the
   115      error log. Most look similar to the example above. The error
   116      log will also contain debugging output from CGI scripts. Any
   117      information written to <code>stderr</code> by a CGI script will
   118      be copied directly to the error log.</p>
   119  
   120      <p>It is not possible to customize the error log by adding or
   121      removing information. However, error log entries dealing with
   122      particular requests have corresponding entries in the <a href="#accesslog">access log</a>. For example, the above example
   123      entry corresponds to an access log entry with status code 403.
   124      Since it is possible to customize the access log, you can
   125      obtain more information about error conditions using that log
   126      file.</p>
   127  
   128      <p>During testing, it is often useful to continuously monitor
   129      the error log for any problems. On Unix systems, you can
   130      accomplish this using:</p>
   131  
   132      <div class="example"><p><code>
   133        tail -f error_log
   134      </code></p></div>
   135    </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
   136  <div class="section">
   137  <h2><a name="accesslog" id="accesslog">Access Log</a></h2>
   138      
   139  
   140      <table class="related"><tr><th>Related Modules</th><th>Related Directives</th></tr><tr><td><ul><li><code class="module"><a href="./mod/mod_log_config.html">mod_log_config</a></code></li><li><code class="module"><a href="./mod/mod_setenvif.html">mod_setenvif</a></code></li></ul></td><td><ul><li><code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code></li><li><code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code></li><li><code class="directive"><a href="./mod/mod_setenvif.html#setenvif">SetEnvIf</a></code></li></ul></td></tr></table>
   141  
   142      <p>The server access log records all requests processed by the
   143      server. The location and content of the access log are
   144      controlled by the <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code>
   145      directive. The <code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code>
   146      directive can be used to simplify the selection of 
   147      the contents of the logs. This section describes how to configure the server
   148      to record information in the access log.</p>
   149  
   150      <p>Of course, storing the information in the access log is only
   151      the start of log management. The next step is to analyze this
   152      information to produce useful statistics. Log analysis in
   153      general is beyond the scope of this document, and not really
   154      part of the job of the web server itself. For more information
   155      about this topic, and for applications which perform log
   156      analysis, check the <a href="http://dmoz.org/Computers/Software/Internet/Site_Management/Log_analysis/">
   157      Open Directory</a> or <a href="http://dir.yahoo.com/Computers_and_Internet/Software/Internet/World_Wide_Web/Servers/Log_Analysis_Tools/">
   158      Yahoo</a>.</p>
   159  
   160      <p>Various versions of Apache httpd have used other modules and
   161      directives to control access logging, including
   162      mod_log_referer, mod_log_agent, and the
   163      <code>TransferLog</code> directive. The <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> directive now subsumes
   164  	the functionality of all the older directives.</p>
   165  
   166      <p>The format of the access log is highly configurable. The format
   167      is specified using a format string that looks much like a C-style
   168      printf(1) format string. Some examples are presented in the next
   169      sections. For a complete list of the possible contents of the
   170      format string, see the <code class="module"><a href="./mod/mod_log_config.html">mod_log_config</a></code> <a href="mod/mod_log_config.html#formats">format strings</a>.</p>
   171  
   172      <h3><a name="common" id="common">Common Log Format</a></h3>
   173        
   174  
   175        <p>A typical configuration for the access log might look as
   176        follows.</p>
   177  
   178        <div class="example"><p><code>
   179          LogFormat "%h %l %u %t \"%r\" %&gt;s %b" common<br />
   180           CustomLog logs/access_log common
   181        </code></p></div>
   182  
   183        <p>This defines the <em>nickname</em> <code>common</code> and
   184        associates it with a particular log format string. The format
   185        string consists of percent directives, each of which tell the
   186        server to log a particular piece of information. Literal
   187        characters may also be placed in the format string and will be
   188        copied directly into the log output. The quote character
   189        (<code>"</code>) must be escaped by placing a backslash before
   190        it to prevent it from being interpreted as the end of the
   191        format string. The format string may also contain the special
   192        control characters "<code>\n</code>" for new-line and
   193        "<code>\t</code>" for tab.</p>
   194  
   195        <p>The <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code>
   196  	  directive sets up a new log file using the defined
   197  	  <em>nickname</em>. The filename for the access log is relative to
   198  	  the <code class="directive"><a href="./mod/core.html#serverroot">ServerRoot</a></code> unless it
   199  	  begins with a slash.</p>
   200  
   201        <p>The above configuration will write log entries in a format
   202        known as the Common Log Format (CLF). This standard format can
   203        be produced by many different web servers and read by many log
   204        analysis programs. The log file entries produced in CLF will
   205        look something like this:</p>
   206  
   207        <div class="example"><p><code>
   208          127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET
   209          /apache_pb.gif HTTP/1.0" 200 2326
   210        </code></p></div>
   211  
   212        <p>Each part of this log entry is described below.</p>
   213  
   214        <dl>
   215          <dt><code>127.0.0.1</code> (<code>%h</code>)</dt>
   216  
   217          <dd>This is the IP address of the client (remote host) which
   218          made the request to the server. If <code class="directive"><a href="./mod/core.html#hostnamelookups">HostnameLookups</a></code> is
   219          set to <code>On</code>, then the server will try to determine
   220          the hostname and log it in place of the IP address. However,
   221          this configuration is not recommended since it can
   222          significantly slow the server. Instead, it is best to use a
   223          log post-processor such as <code class="program"><a href="./programs/logresolve.html">logresolve</a></code> to determine
   224          the hostnames. The IP address reported here is not
   225          necessarily the address of the machine at which the user is
   226          sitting. If a proxy server exists between the user and the
   227          server, this address will be the address of the proxy, rather
   228          than the originating machine.</dd>
   229  
   230          <dt><code>-</code> (<code>%l</code>)</dt>
   231  
   232          <dd>The "hyphen" in the output indicates that the requested
   233          piece of information is not available. In this case, the
   234          information that is not available is the RFC 1413 identity of
   235          the client determined by <code>identd</code> on the clients
   236          machine. This information is highly unreliable and should
   237          almost never be used except on tightly controlled internal
   238          networks. Apache httpd will not even attempt to determine
   239          this information unless <code class="directive"><a href="./mod/mod_ident.html#identitycheck">IdentityCheck</a></code> is set
   240          to <code>On</code>.</dd>
   241  
   242          <dt><code>frank</code> (<code>%u</code>)</dt>
   243  
   244          <dd>This is the userid of the person requesting the document
   245          as determined by HTTP authentication. The same value is
   246          typically provided to CGI scripts in the
   247          <code>REMOTE_USER</code> environment variable. If the status
   248          code for the request (see below) is 401, then this value
   249          should not be trusted because the user is not yet
   250          authenticated. If the document is not password protected,
   251          this part will be "<code>-</code>" just like the previous
   252          one.</dd>
   253  
   254          <dt><code>[10/Oct/2000:13:55:36 -0700]</code>
   255          (<code>%t</code>)</dt>
   256  
   257          <dd>
   258            The time that the request was received.
   259            The format is: 
   260  
   261            <p class="indent">
   262              <code>[day/month/year:hour:minute:second zone]<br />
   263               day = 2*digit<br />
   264               month = 3*letter<br />
   265               year = 4*digit<br />
   266               hour = 2*digit<br />
   267               minute = 2*digit<br />
   268               second = 2*digit<br />
   269               zone = (`+' | `-') 4*digit</code>
   270            </p>
   271            It is possible to have the time displayed in another format
   272            by specifying <code>%{format}t</code> in the log format
   273            string, where <code>format</code> is as in
   274            <code>strftime(3)</code> from the C standard library.
   275          </dd>
   276  
   277          <dt><code>"GET /apache_pb.gif HTTP/1.0"</code>
   278          (<code>\"%r\"</code>)</dt>
   279  
   280          <dd>The request line from the client is given in double
   281          quotes. The request line contains a great deal of useful
   282          information. First, the method used by the client is
   283          <code>GET</code>. Second, the client requested the resource
   284          <code>/apache_pb.gif</code>, and third, the client used the
   285          protocol <code>HTTP/1.0</code>. It is also possible to log
   286          one or more parts of the request line independently. For
   287          example, the format string "<code>%m %U%q %H</code>" will log
   288          the method, path, query-string, and protocol, resulting in
   289          exactly the same output as "<code>%r</code>".</dd>
   290  
   291          <dt><code>200</code> (<code>%&gt;s</code>)</dt>
   292  
   293          <dd>This is the status code that the server sends back to the
   294          client. This information is very valuable, because it reveals
   295          whether the request resulted in a successful response (codes
   296          beginning in 2), a redirection (codes beginning in 3), an
   297          error caused by the client (codes beginning in 4), or an
   298          error in the server (codes beginning in 5). The full list of
   299          possible status codes can be found in the <a href="http://www.w3.org/Protocols/rfc2616/rfc2616.txt">HTTP
   300          specification</a> (RFC2616 section 10).</dd>
   301  
   302          <dt><code>2326</code> (<code>%b</code>)</dt>
   303  
   304          <dd>The last part indicates the size of the object returned
   305          to the client, not including the response headers. If no
   306          content was returned to the client, this value will be
   307          "<code>-</code>". To log "<code>0</code>" for no content, use
   308          <code>%B</code> instead.</dd>
   309        </dl>
   310      
   311  
   312      <h3><a name="combined" id="combined">Combined Log Format</a></h3>
   313        
   314  
   315        <p>Another commonly used format string is called the Combined
   316        Log Format. It can be used as follows.</p>
   317  
   318        <div class="example"><p><code>
   319          LogFormat "%h %l %u %t \"%r\" %&gt;s %b \"%{Referer}i\"
   320          \"%{User-agent}i\"" combined<br />
   321           CustomLog log/access_log combined
   322        </code></p></div>
   323  
   324        <p>This format is exactly the same as the Common Log Format,
   325        with the addition of two more fields. Each of the additional
   326        fields uses the percent-directive
   327        <code>%{<em>header</em>}i</code>, where <em>header</em> can be
   328        any HTTP request header. The access log under this format will
   329        look like:</p>
   330  
   331        <div class="example"><p><code>
   332          127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET
   333          /apache_pb.gif HTTP/1.0" 200 2326
   334          "http://www.example.com/start.html" "Mozilla/4.08 [en]
   335          (Win98; I ;Nav)"
   336        </code></p></div>
   337  
   338        <p>The additional fields are:</p>
   339  
   340        <dl>
   341          <dt><code>"http://www.example.com/start.html"</code>
   342          (<code>\"%{Referer}i\"</code>)</dt>
   343  
   344          <dd>The "Referer" (sic) HTTP request header. This gives the
   345          site that the client reports having been referred from. (This
   346          should be the page that links to or includes
   347          <code>/apache_pb.gif</code>).</dd>
   348  
   349          <dt><code>"Mozilla/4.08 [en] (Win98; I ;Nav)"</code>
   350          (<code>\"%{User-agent}i\"</code>)</dt>
   351  
   352          <dd>The User-Agent HTTP request header. This is the
   353          identifying information that the client browser reports about
   354          itself.</dd>
   355        </dl>
   356      
   357  
   358      <h3><a name="multiple" id="multiple">Multiple Access Logs</a></h3>
   359        
   360  
   361        <p>Multiple access logs can be created simply by specifying
   362        multiple <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> 
   363        directives in the configuration
   364        file. For example, the following directives will create three
   365        access logs. The first contains the basic CLF information,
   366        while the second and third contain referer and browser
   367        information. The last two <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> lines show how
   368        to mimic the effects of the <code>ReferLog</code> and <code>AgentLog</code> directives.</p>
   369  
   370        <div class="example"><p><code>
   371          LogFormat "%h %l %u %t \"%r\" %&gt;s %b" common<br />
   372          CustomLog logs/access_log common<br />
   373          CustomLog logs/referer_log "%{Referer}i -&gt; %U"<br />
   374          CustomLog logs/agent_log "%{User-agent}i"
   375        </code></p></div>
   376  
   377        <p>This example also shows that it is not necessary to define a
   378        nickname with the <code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code> directive. Instead,
   379        the log format can be specified directly in the <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> directive.</p>
   380      
   381  
   382      <h3><a name="conditional" id="conditional">Conditional Logs</a></h3>
   383        
   384  
   385        <p>There are times when it is convenient to exclude certain
   386        entries from the access logs based on characteristics of the
   387        client request. This is easily accomplished with the help of <a href="env.html">environment variables</a>. First, an
   388        environment variable must be set to indicate that the request
   389        meets certain conditions. This is usually accomplished with 
   390        <code class="directive"><a href="./mod/mod_setenvif.html#setenvif">SetEnvIf</a></code>. Then the
   391        <code>env=</code> clause of the <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> directive is used to
   392  	  include or exclude requests where the environment variable is
   393  	  set. Some examples:</p>
   394  
   395        <div class="example"><p><code>
   396          # Mark requests from the loop-back interface<br />
   397          SetEnvIf Remote_Addr "127\.0\.0\.1" dontlog<br />
   398          # Mark requests for the robots.txt file<br />
   399          SetEnvIf Request_URI "^/robots\.txt$" dontlog<br />
   400          # Log what remains<br />
   401          CustomLog logs/access_log common env=!dontlog
   402        </code></p></div>
   403  
   404        <p>As another example, consider logging requests from
   405        english-speakers to one log file, and non-english speakers to a
   406        different log file.</p>
   407  
   408        <div class="example"><p><code>
   409          SetEnvIf Accept-Language "en" english<br />
   410          CustomLog logs/english_log common env=english<br />
   411          CustomLog logs/non_english_log common env=!english
   412        </code></p></div>
   413  
   414        <p>Although we have just shown that conditional logging is very
   415        powerful and flexible, it is not the only way to control the
   416        contents of the logs. Log files are more useful when they
   417        contain a complete record of server activity. It is often
   418        easier to simply post-process the log files to remove requests
   419        that you do not want to consider.</p>
   420      
   421    </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
   422  <div class="section">
   423  <h2><a name="rotation" id="rotation">Log Rotation</a></h2>
   424      
   425  
   426      <p>On even a moderately busy server, the quantity of
   427      information stored in the log files is very large. The access
   428      log file typically grows 1 MB or more per 10,000 requests. It
   429      will consequently be necessary to periodically rotate the log
   430      files by moving or deleting the existing logs. This cannot be
   431      done while the server is running, because Apache will continue
   432      writing to the old log file as long as it holds the file open.
   433      Instead, the server must be <a href="stopping.html">restarted</a> after the log files are
   434      moved or deleted so that it will open new log files.</p>
   435  
   436      <p>By using a <em>graceful</em> restart, the server can be
   437      instructed to open new log files without losing any existing or
   438      pending connections from clients. However, in order to
   439      accomplish this, the server must continue to write to the old
   440      log files while it finishes serving old requests. It is
   441      therefore necessary to wait for some time after the restart
   442      before doing any processing on the log files. A typical
   443      scenario that simply rotates the logs and compresses the old
   444      logs to save space is:</p>
   445  
   446      <div class="example"><p><code>
   447        mv access_log access_log.old<br />
   448        mv error_log error_log.old<br />
   449        apachectl graceful<br />
   450        sleep 600<br />
   451        gzip access_log.old error_log.old
   452      </code></p></div>
   453  
   454      <p>Another way to perform log rotation is using <a href="#piped">piped logs</a> as discussed in the next
   455      section.</p>
   456    </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
   457  <div class="section">
   458  <h2><a name="piped" id="piped">Piped Logs</a></h2>
   459      
   460  
   461      <p>Apache httpd is capable of writing error and access log
   462      files through a pipe to another process, rather than directly
   463      to a file. This capability dramatically increases the
   464      flexibility of logging, without adding code to the main server.
   465      In order to write logs to a pipe, simply replace the filename
   466      with the pipe character "<code>|</code>", followed by the name
   467      of the executable which should accept log entries on its
   468      standard input. Apache will start the piped-log process when
   469      the server starts, and will restart it if it crashes while the
   470      server is running. (This last feature is why we can refer to
   471      this technique as "reliable piped logging".)</p>
   472  
   473      <p>Piped log processes are spawned by the parent Apache httpd
   474      process, and inherit the userid of that process. This means
   475      that piped log programs usually run as root. It is therefore
   476      very important to keep the programs simple and secure.</p>
   477  
   478      <p>One important use of piped logs is to allow log rotation
   479      without having to restart the server. The Apache HTTP Server
   480      includes a simple program called <code class="program"><a href="./programs/rotatelogs.html">rotatelogs</a></code>
   481      for this purpose. For example, to rotate the logs every 24 hours, you
   482      can use:</p>
   483  
   484      <div class="example"><p><code>
   485        CustomLog "|/usr/local/apache/bin/rotatelogs
   486        /var/log/access_log 86400" common
   487      </code></p></div>
   488  
   489      <p>Notice that quotes are used to enclose the entire command
   490      that will be called for the pipe. Although these examples are
   491      for the access log, the same technique can be used for the
   492      error log.</p>
   493  
   494      <p>As with conditional logging, piped logs are a very powerful
   495      tool, but they should not be used where a simpler solution like
   496      off-line post-processing is available.</p>
   497  
   498      <p>By default the piped log process is spawned using a shell.
   499      (usually with <code>/bin/sh -c</code>).
   500      Depending on the shell specifics invocation via shell might
   501      lead to an additional shell process for the lifetime of the
   502      logging pipe program and signal handling problems during
   503      restart.</p>
   504  
   505      <p>Use "<code>||</code>" instead of "<code>|</code>"
   506      to spawn without invoking a shell:</p>
   507  
   508      <div class="example"><p><code>
   509        # Invoke "rotatelogs" without using a shell<br />
   510        CustomLog "||/usr/local/apache/bin/rotatelogs
   511        /var/log/access_log 86400" common
   512      </code></p></div>
   513  
   514      <div class="note"><h3>Windows note</h3>
   515      <p>Note that on Windows, you may run into problems when running many piped
   516      logger processes, especially when HTTPD is running as a service. This is
   517      caused by running out of desktop heap space. The desktop heap space given
   518      to each service is specified by the third argument to the
   519      <code>SharedSection</code> parameter in the
   520      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager\SubSystems\Windows
   521      registry value. <strong>Change this value with care</strong>; the normal
   522      caveats for changing the Windows registry apply, but you might also exhaust
   523      the desktop heap pool if the number is adjusted too high.</p>
   524      </div>
   525    </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
   526  <div class="section">
   527  <h2><a name="virtualhost" id="virtualhost">Virtual Hosts</a></h2>
   528      
   529  
   530      <p>When running a server with many <a href="vhosts/">virtual
   531      hosts</a>, there are several options for dealing with log
   532      files. First, it is possible to use logs exactly as in a
   533      single-host server. Simply by placing the logging directives
   534      outside the <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> sections in the
   535      main server context, it is possible to log all requests in the
   536      same access log and error log. This technique does not allow
   537      for easy collection of statistics on individual virtual
   538      hosts.</p>
   539  
   540      <p>If <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> 
   541      or <code class="directive"><a href="./mod/core.html#errorlog">ErrorLog</a></code>
   542      directives are placed inside a
   543      <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>
   544      section, all requests or errors for that virtual host will be
   545      logged only to the specified file. Any virtual host which does
   546      not have logging directives will still have its requests sent
   547      to the main server logs. This technique is very useful for a
   548      small number of virtual hosts, but if the number of hosts is
   549      very large, it can be complicated to manage. In addition, it
   550      can often create problems with <a href="vhosts/fd-limits.html">insufficient file
   551      descriptors</a>.</p>
   552  
   553      <p>For the access log, there is a very good compromise. By
   554      adding information on the virtual host to the log format
   555      string, it is possible to log all hosts to the same log, and
   556      later split the log into individual files. For example,
   557      consider the following directives.</p>
   558  
   559      <div class="example"><p><code>
   560        LogFormat "%v %l %u %t \"%r\" %&gt;s %b"
   561        comonvhost<br />
   562        CustomLog logs/access_log comonvhost
   563      </code></p></div>
   564  
   565      <p>The <code>%v</code> is used to log the name of the virtual
   566      host that is serving the request. Then a program like <a href="programs/other.html">split-logfile</a> can be used to
   567      post-process the access log in order to split it into one file
   568      per virtual host.</p>
   569    </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
   570  <div class="section">
   571  <h2><a name="other" id="other">Other Log Files</a></h2>
   572      
   573  
   574      <table class="related"><tr><th>Related Modules</th><th>Related Directives</th></tr><tr><td><ul><li><code class="module"><a href="./mod/mod_logio.html">mod_logio</a></code></li><li><code class="module"><a href="./mod/mod_log_forensic.html">mod_log_forensic</a></code></li><li><code class="module"><a href="./mod/mod_cgi.html">mod_cgi</a></code></li><li><code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code></li><li><code class="module"><a href="./mod/mod_log_config.html">mod_log_config</a></code></li></ul></td><td><ul><li><code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code></li><li><code class="directive"><a href="./mod/mod_log_config.html#bufferedlogs">BufferedLogs</a></code></li><li><code class="directive"><a href="./mod/mod_log_forensic.html#forensiclog">ForensicLog</a></code></li><li><code class="directive"><a href="./mod/mpm_common.html#pidfile">PidFile</a></code></li><li><code class="directive"><a href="./mod/mod_rewrite.html#rewritelog">RewriteLog</a></code></li><li><code class="directive"><a href="./mod/mod_rewrite.html#rewriteloglevel">RewriteLogLevel</a></code></li><li><code class="directive"><a href="./mod/mod_cgi.html#scriptlog">ScriptLog</a></code></li><li><code class="directive"><a href="./mod/mod_cgi.html#scriptlogbuffer">ScriptLogBuffer</a></code></li><li><code class="directive"><a href="./mod/mod_cgi.html#scriptloglength">ScriptLogLength</a></code></li></ul></td></tr></table>
   575  
   576      <h3>Logging actual bytes sent and received</h3>
   577        
   578  
   579        <p><code class="module"><a href="./mod/mod_logio.html">mod_logio</a></code> adds in two additional
   580           <code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code> fields
   581           (%I and %O) that log the actual number of bytes received and sent
   582           on the network.</p>
   583      
   584  
   585      <h3>Forensic Logging</h3>
   586        
   587  
   588        <p><code class="module"><a href="./mod/mod_log_forensic.html">mod_log_forensic</a></code> provides for forensic logging of
   589           client requests. Logging is done before and after processing a
   590           request, so the forensic log contains two log lines for each
   591           request. The forensic logger is very strict with no customizations.
   592           It can be an invaluable debugging and security tool.</p>
   593      
   594  
   595      <h3><a name="pidfile" id="pidfile">PID File</a></h3>
   596        
   597  
   598        <p>On startup, Apache httpd saves the process id of the parent
   599        httpd process to the file <code>logs/httpd.pid</code>. This
   600        filename can be changed with the <code class="directive"><a href="./mod/mpm_common.html#pidfile">PidFile</a></code> directive. The
   601        process-id is for use by the administrator in restarting and
   602        terminating the daemon by sending signals to the parent
   603        process; on Windows, use the -k command line option instead.
   604        For more information see the <a href="stopping.html">Stopping
   605        and Restarting</a> page.</p>    
   606      
   607  
   608      <h3><a name="scriptlog" id="scriptlog">Script Log</a></h3>
   609        
   610  
   611        <p>In order to aid in debugging, the
   612        <code class="directive"><a href="./mod/mod_cgi.html#scriptlog">ScriptLog</a></code> directive
   613        allows you to record the input to and output from CGI scripts.
   614        This should only be used in testing - not for live servers.
   615        More information is available in the <a href="mod/mod_cgi.html">mod_cgi</a> documentation.</p>
   616      
   617  
   618      <h3><a name="rewritelog" id="rewritelog">Rewrite Log</a></h3>
   619        
   620  
   621        <p>When using the powerful and complex features of <a href="mod/mod_rewrite.html">mod_rewrite</a>, it is almost
   622        always necessary to use the <code class="directive"><a href="./mod/mod_rewrite.html#rewritelog">RewriteLog</a></code> to help
   623        in debugging. This log file produces a detailed analysis of how
   624        the rewriting engine transforms requests. The level of detail
   625        is controlled by the <code class="directive"><a href="./mod/mod_rewrite.html#rewriteloglevel">RewriteLogLevel</a></code> directive.</p>
   626      
   627    </div></div>
   628  <div class="bottomlang">
   629  <p><span>Available Languages: </span><a href="./en/logs.html" title="English">&nbsp;en&nbsp;</a> |
   630  <a href="./fr/logs.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
   631  <a href="./ja/logs.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
   632  <a href="./ko/logs.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
   633  <a href="./tr/logs.html" hreflang="tr" rel="alternate" title="Türkçe">&nbsp;tr&nbsp;</a></p>
   634  </div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
   635  <script type="text/javascript"><!--//--><![CDATA[//><!--
   636  var comments_shortname = 'httpd';
   637  var comments_identifier = 'http://httpd.apache.org/docs/2.2/logs.html';
   638  (function(w, d) {
   639      if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
   640          d.write('<div id="comments_thread"><\/div>');
   641          var s = d.createElement('script');
   642          s.type = 'text/javascript';
   643          s.async = true;
   644          s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
   645          (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
   646      }
   647      else { 
   648          d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
   649      }
   650  })(window, document);
   651  //--><!]]></script></div><div id="footer">
   652  <p class="apache">Copyright 2017 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
   653  <p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
   654  if (typeof(prettyPrint) !== 'undefined') {
   655      prettyPrint();
   656  }
   657  //--><!]]></script>
   658  </body></html>