github.com/krum110487/go-htaccess@v0.0.0-20240316004156-60641c8e7598/tests/data/apache_2_2_34/manual/logs.html.en (about) 1 <?xml version="1.0" encoding="ISO-8859-1"?> 2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head> 4 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" /> 5 <!-- 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 This file is generated from xml source: DO NOT EDIT 8 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 9 --> 10 <title>Log Files - Apache HTTP Server Version 2.2</title> 11 <link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> 12 <link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> 13 <link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" /> 14 <script src="./style/scripts/prettify.min.js" type="text/javascript"> 15 </script> 16 17 <link href="./images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/logs.html" rel="canonical" /></head> 18 <body id="manual-page"><div id="page-header"> 19 <p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p> 20 <p class="apache">Apache HTTP Server Version 2.2</p> 21 <img alt="" src="./images/feather.gif" /></div> 22 <div class="up"><a href="./"><img title="<-" alt="<-" src="./images/left.gif" /></a></div> 23 <div id="path"> 24 <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="./">Version 2.2</a></div><div id="page-content"><div class="retired"><h4>Please note</h4> 25 <p> This document refers to a legacy release (<strong>2.2</strong>) of Apache httpd. The active release (<strong>2.4</strong>) is documented <a href="http://httpd.apache.org/docs/current">here</a>. If you have not already upgraded, please follow <a href="http://httpd.apache.org/docs/current/upgrading.html">this link</a> for more information.</p> 26 <p>You may follow <a href="http://httpd.apache.org/docs/current/logs.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>Log Files</h1> 27 <div class="toplang"> 28 <p><span>Available Languages: </span><a href="./en/logs.html" title="English"> en </a> | 29 <a href="./fr/logs.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | 30 <a href="./ja/logs.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | 31 <a href="./ko/logs.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | 32 <a href="./tr/logs.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> 33 </div> 34 35 <p>In order to effectively manage a web server, it is necessary 36 to get feedback about the activity and performance of the 37 server as well as any problems that may be occurring. The Apache 38 HTTP Server provides very comprehensive and flexible logging 39 capabilities. This document describes how to configure its 40 logging capabilities, and how to understand what the logs 41 contain.</p> 42 </div> 43 <div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#security">Security Warning</a></li> 44 <li><img alt="" src="./images/down.gif" /> <a href="#errorlog">Error Log</a></li> 45 <li><img alt="" src="./images/down.gif" /> <a href="#accesslog">Access Log</a></li> 46 <li><img alt="" src="./images/down.gif" /> <a href="#rotation">Log Rotation</a></li> 47 <li><img alt="" src="./images/down.gif" /> <a href="#piped">Piped Logs</a></li> 48 <li><img alt="" src="./images/down.gif" /> <a href="#virtualhost">Virtual Hosts</a></li> 49 <li><img alt="" src="./images/down.gif" /> <a href="#other">Other Log Files</a></li> 50 </ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div> 51 <div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 52 <div class="section"> 53 <h2><a name="security" id="security">Security Warning</a></h2> 54 55 56 <p>Anyone who can write to the directory where Apache is 57 writing a log file can almost certainly gain access to the uid 58 that the server is started as, which is normally root. Do 59 <em>NOT</em> give people write access to the directory the logs 60 are stored in without being aware of the consequences; see the 61 <a href="misc/security_tips.html">security tips</a> document 62 for details.</p> 63 64 <p>In addition, log files may contain information supplied 65 directly by the client, without escaping. Therefore, it is 66 possible for malicious clients to insert control-characters in 67 the log files, so care must be taken in dealing with raw 68 logs.</p> 69 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 70 <div class="section"> 71 <h2><a name="errorlog" id="errorlog">Error Log</a></h2> 72 73 74 <table class="related"><tr><th>Related Modules</th><th>Related Directives</th></tr><tr><td /><td><ul><li><code class="directive"><a href="./mod/core.html#errorlog">ErrorLog</a></code></li><li><code class="directive"><a href="./mod/core.html#loglevel">LogLevel</a></code></li></ul></td></tr></table> 75 76 <p>The server error log, whose name and location is set by the 77 <code class="directive"><a href="./mod/core.html#errorlog">ErrorLog</a></code> directive, is the 78 most important log file. This is the place where Apache httpd 79 will send diagnostic information and record any errors that it 80 encounters in processing requests. It is the first place to 81 look when a problem occurs with starting the server or with the 82 operation of the server, since it will often contain details of 83 what went wrong and how to fix it.</p> 84 85 <p>The error log is usually written to a file (typically 86 <code>error_log</code> on Unix systems and 87 <code>error.log</code> on Windows and OS/2). On Unix systems it 88 is also possible to have the server send errors to 89 <code>syslog</code> or <a href="#piped">pipe them to a 90 program</a>.</p> 91 92 <p>The format of the error log is relatively free-form and 93 descriptive. But there is certain information that is contained 94 in most error log entries. For example, here is a typical 95 message.</p> 96 97 <div class="example"><p><code> 98 [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] 99 client denied by server configuration: 100 /export/home/live/ap/htdocs/test 101 </code></p></div> 102 103 <p>The first item in the log entry is the date and time of the 104 message. The second item lists the severity of the error being 105 reported. The <code class="directive"><a href="./mod/core.html#loglevel">LogLevel</a></code> 106 directive is used to control the types of errors that are sent 107 to the error log by restricting the severity level. The third 108 item gives the IP address of the client that generated the 109 error. Beyond that is the message itself, which in this case 110 indicates that the server has been configured to deny the 111 client access. The server reports the file-system path (as 112 opposed to the web path) of the requested document.</p> 113 114 <p>A very wide variety of different messages can appear in the 115 error log. Most look similar to the example above. The error 116 log will also contain debugging output from CGI scripts. Any 117 information written to <code>stderr</code> by a CGI script will 118 be copied directly to the error log.</p> 119 120 <p>It is not possible to customize the error log by adding or 121 removing information. However, error log entries dealing with 122 particular requests have corresponding entries in the <a href="#accesslog">access log</a>. For example, the above example 123 entry corresponds to an access log entry with status code 403. 124 Since it is possible to customize the access log, you can 125 obtain more information about error conditions using that log 126 file.</p> 127 128 <p>During testing, it is often useful to continuously monitor 129 the error log for any problems. On Unix systems, you can 130 accomplish this using:</p> 131 132 <div class="example"><p><code> 133 tail -f error_log 134 </code></p></div> 135 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 136 <div class="section"> 137 <h2><a name="accesslog" id="accesslog">Access Log</a></h2> 138 139 140 <table class="related"><tr><th>Related Modules</th><th>Related Directives</th></tr><tr><td><ul><li><code class="module"><a href="./mod/mod_log_config.html">mod_log_config</a></code></li><li><code class="module"><a href="./mod/mod_setenvif.html">mod_setenvif</a></code></li></ul></td><td><ul><li><code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code></li><li><code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code></li><li><code class="directive"><a href="./mod/mod_setenvif.html#setenvif">SetEnvIf</a></code></li></ul></td></tr></table> 141 142 <p>The server access log records all requests processed by the 143 server. The location and content of the access log are 144 controlled by the <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> 145 directive. The <code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code> 146 directive can be used to simplify the selection of 147 the contents of the logs. This section describes how to configure the server 148 to record information in the access log.</p> 149 150 <p>Of course, storing the information in the access log is only 151 the start of log management. The next step is to analyze this 152 information to produce useful statistics. Log analysis in 153 general is beyond the scope of this document, and not really 154 part of the job of the web server itself. For more information 155 about this topic, and for applications which perform log 156 analysis, check the <a href="http://dmoz.org/Computers/Software/Internet/Site_Management/Log_analysis/"> 157 Open Directory</a> or <a href="http://dir.yahoo.com/Computers_and_Internet/Software/Internet/World_Wide_Web/Servers/Log_Analysis_Tools/"> 158 Yahoo</a>.</p> 159 160 <p>Various versions of Apache httpd have used other modules and 161 directives to control access logging, including 162 mod_log_referer, mod_log_agent, and the 163 <code>TransferLog</code> directive. The <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> directive now subsumes 164 the functionality of all the older directives.</p> 165 166 <p>The format of the access log is highly configurable. The format 167 is specified using a format string that looks much like a C-style 168 printf(1) format string. Some examples are presented in the next 169 sections. For a complete list of the possible contents of the 170 format string, see the <code class="module"><a href="./mod/mod_log_config.html">mod_log_config</a></code> <a href="mod/mod_log_config.html#formats">format strings</a>.</p> 171 172 <h3><a name="common" id="common">Common Log Format</a></h3> 173 174 175 <p>A typical configuration for the access log might look as 176 follows.</p> 177 178 <div class="example"><p><code> 179 LogFormat "%h %l %u %t \"%r\" %>s %b" common<br /> 180 CustomLog logs/access_log common 181 </code></p></div> 182 183 <p>This defines the <em>nickname</em> <code>common</code> and 184 associates it with a particular log format string. The format 185 string consists of percent directives, each of which tell the 186 server to log a particular piece of information. Literal 187 characters may also be placed in the format string and will be 188 copied directly into the log output. The quote character 189 (<code>"</code>) must be escaped by placing a backslash before 190 it to prevent it from being interpreted as the end of the 191 format string. The format string may also contain the special 192 control characters "<code>\n</code>" for new-line and 193 "<code>\t</code>" for tab.</p> 194 195 <p>The <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> 196 directive sets up a new log file using the defined 197 <em>nickname</em>. The filename for the access log is relative to 198 the <code class="directive"><a href="./mod/core.html#serverroot">ServerRoot</a></code> unless it 199 begins with a slash.</p> 200 201 <p>The above configuration will write log entries in a format 202 known as the Common Log Format (CLF). This standard format can 203 be produced by many different web servers and read by many log 204 analysis programs. The log file entries produced in CLF will 205 look something like this:</p> 206 207 <div class="example"><p><code> 208 127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET 209 /apache_pb.gif HTTP/1.0" 200 2326 210 </code></p></div> 211 212 <p>Each part of this log entry is described below.</p> 213 214 <dl> 215 <dt><code>127.0.0.1</code> (<code>%h</code>)</dt> 216 217 <dd>This is the IP address of the client (remote host) which 218 made the request to the server. If <code class="directive"><a href="./mod/core.html#hostnamelookups">HostnameLookups</a></code> is 219 set to <code>On</code>, then the server will try to determine 220 the hostname and log it in place of the IP address. However, 221 this configuration is not recommended since it can 222 significantly slow the server. Instead, it is best to use a 223 log post-processor such as <code class="program"><a href="./programs/logresolve.html">logresolve</a></code> to determine 224 the hostnames. The IP address reported here is not 225 necessarily the address of the machine at which the user is 226 sitting. If a proxy server exists between the user and the 227 server, this address will be the address of the proxy, rather 228 than the originating machine.</dd> 229 230 <dt><code>-</code> (<code>%l</code>)</dt> 231 232 <dd>The "hyphen" in the output indicates that the requested 233 piece of information is not available. In this case, the 234 information that is not available is the RFC 1413 identity of 235 the client determined by <code>identd</code> on the clients 236 machine. This information is highly unreliable and should 237 almost never be used except on tightly controlled internal 238 networks. Apache httpd will not even attempt to determine 239 this information unless <code class="directive"><a href="./mod/mod_ident.html#identitycheck">IdentityCheck</a></code> is set 240 to <code>On</code>.</dd> 241 242 <dt><code>frank</code> (<code>%u</code>)</dt> 243 244 <dd>This is the userid of the person requesting the document 245 as determined by HTTP authentication. The same value is 246 typically provided to CGI scripts in the 247 <code>REMOTE_USER</code> environment variable. If the status 248 code for the request (see below) is 401, then this value 249 should not be trusted because the user is not yet 250 authenticated. If the document is not password protected, 251 this part will be "<code>-</code>" just like the previous 252 one.</dd> 253 254 <dt><code>[10/Oct/2000:13:55:36 -0700]</code> 255 (<code>%t</code>)</dt> 256 257 <dd> 258 The time that the request was received. 259 The format is: 260 261 <p class="indent"> 262 <code>[day/month/year:hour:minute:second zone]<br /> 263 day = 2*digit<br /> 264 month = 3*letter<br /> 265 year = 4*digit<br /> 266 hour = 2*digit<br /> 267 minute = 2*digit<br /> 268 second = 2*digit<br /> 269 zone = (`+' | `-') 4*digit</code> 270 </p> 271 It is possible to have the time displayed in another format 272 by specifying <code>%{format}t</code> in the log format 273 string, where <code>format</code> is as in 274 <code>strftime(3)</code> from the C standard library. 275 </dd> 276 277 <dt><code>"GET /apache_pb.gif HTTP/1.0"</code> 278 (<code>\"%r\"</code>)</dt> 279 280 <dd>The request line from the client is given in double 281 quotes. The request line contains a great deal of useful 282 information. First, the method used by the client is 283 <code>GET</code>. Second, the client requested the resource 284 <code>/apache_pb.gif</code>, and third, the client used the 285 protocol <code>HTTP/1.0</code>. It is also possible to log 286 one or more parts of the request line independently. For 287 example, the format string "<code>%m %U%q %H</code>" will log 288 the method, path, query-string, and protocol, resulting in 289 exactly the same output as "<code>%r</code>".</dd> 290 291 <dt><code>200</code> (<code>%>s</code>)</dt> 292 293 <dd>This is the status code that the server sends back to the 294 client. This information is very valuable, because it reveals 295 whether the request resulted in a successful response (codes 296 beginning in 2), a redirection (codes beginning in 3), an 297 error caused by the client (codes beginning in 4), or an 298 error in the server (codes beginning in 5). The full list of 299 possible status codes can be found in the <a href="http://www.w3.org/Protocols/rfc2616/rfc2616.txt">HTTP 300 specification</a> (RFC2616 section 10).</dd> 301 302 <dt><code>2326</code> (<code>%b</code>)</dt> 303 304 <dd>The last part indicates the size of the object returned 305 to the client, not including the response headers. If no 306 content was returned to the client, this value will be 307 "<code>-</code>". To log "<code>0</code>" for no content, use 308 <code>%B</code> instead.</dd> 309 </dl> 310 311 312 <h3><a name="combined" id="combined">Combined Log Format</a></h3> 313 314 315 <p>Another commonly used format string is called the Combined 316 Log Format. It can be used as follows.</p> 317 318 <div class="example"><p><code> 319 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" 320 \"%{User-agent}i\"" combined<br /> 321 CustomLog log/access_log combined 322 </code></p></div> 323 324 <p>This format is exactly the same as the Common Log Format, 325 with the addition of two more fields. Each of the additional 326 fields uses the percent-directive 327 <code>%{<em>header</em>}i</code>, where <em>header</em> can be 328 any HTTP request header. The access log under this format will 329 look like:</p> 330 331 <div class="example"><p><code> 332 127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET 333 /apache_pb.gif HTTP/1.0" 200 2326 334 "http://www.example.com/start.html" "Mozilla/4.08 [en] 335 (Win98; I ;Nav)" 336 </code></p></div> 337 338 <p>The additional fields are:</p> 339 340 <dl> 341 <dt><code>"http://www.example.com/start.html"</code> 342 (<code>\"%{Referer}i\"</code>)</dt> 343 344 <dd>The "Referer" (sic) HTTP request header. This gives the 345 site that the client reports having been referred from. (This 346 should be the page that links to or includes 347 <code>/apache_pb.gif</code>).</dd> 348 349 <dt><code>"Mozilla/4.08 [en] (Win98; I ;Nav)"</code> 350 (<code>\"%{User-agent}i\"</code>)</dt> 351 352 <dd>The User-Agent HTTP request header. This is the 353 identifying information that the client browser reports about 354 itself.</dd> 355 </dl> 356 357 358 <h3><a name="multiple" id="multiple">Multiple Access Logs</a></h3> 359 360 361 <p>Multiple access logs can be created simply by specifying 362 multiple <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> 363 directives in the configuration 364 file. For example, the following directives will create three 365 access logs. The first contains the basic CLF information, 366 while the second and third contain referer and browser 367 information. The last two <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> lines show how 368 to mimic the effects of the <code>ReferLog</code> and <code>AgentLog</code> directives.</p> 369 370 <div class="example"><p><code> 371 LogFormat "%h %l %u %t \"%r\" %>s %b" common<br /> 372 CustomLog logs/access_log common<br /> 373 CustomLog logs/referer_log "%{Referer}i -> %U"<br /> 374 CustomLog logs/agent_log "%{User-agent}i" 375 </code></p></div> 376 377 <p>This example also shows that it is not necessary to define a 378 nickname with the <code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code> directive. Instead, 379 the log format can be specified directly in the <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> directive.</p> 380 381 382 <h3><a name="conditional" id="conditional">Conditional Logs</a></h3> 383 384 385 <p>There are times when it is convenient to exclude certain 386 entries from the access logs based on characteristics of the 387 client request. This is easily accomplished with the help of <a href="env.html">environment variables</a>. First, an 388 environment variable must be set to indicate that the request 389 meets certain conditions. This is usually accomplished with 390 <code class="directive"><a href="./mod/mod_setenvif.html#setenvif">SetEnvIf</a></code>. Then the 391 <code>env=</code> clause of the <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> directive is used to 392 include or exclude requests where the environment variable is 393 set. Some examples:</p> 394 395 <div class="example"><p><code> 396 # Mark requests from the loop-back interface<br /> 397 SetEnvIf Remote_Addr "127\.0\.0\.1" dontlog<br /> 398 # Mark requests for the robots.txt file<br /> 399 SetEnvIf Request_URI "^/robots\.txt$" dontlog<br /> 400 # Log what remains<br /> 401 CustomLog logs/access_log common env=!dontlog 402 </code></p></div> 403 404 <p>As another example, consider logging requests from 405 english-speakers to one log file, and non-english speakers to a 406 different log file.</p> 407 408 <div class="example"><p><code> 409 SetEnvIf Accept-Language "en" english<br /> 410 CustomLog logs/english_log common env=english<br /> 411 CustomLog logs/non_english_log common env=!english 412 </code></p></div> 413 414 <p>Although we have just shown that conditional logging is very 415 powerful and flexible, it is not the only way to control the 416 contents of the logs. Log files are more useful when they 417 contain a complete record of server activity. It is often 418 easier to simply post-process the log files to remove requests 419 that you do not want to consider.</p> 420 421 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 422 <div class="section"> 423 <h2><a name="rotation" id="rotation">Log Rotation</a></h2> 424 425 426 <p>On even a moderately busy server, the quantity of 427 information stored in the log files is very large. The access 428 log file typically grows 1 MB or more per 10,000 requests. It 429 will consequently be necessary to periodically rotate the log 430 files by moving or deleting the existing logs. This cannot be 431 done while the server is running, because Apache will continue 432 writing to the old log file as long as it holds the file open. 433 Instead, the server must be <a href="stopping.html">restarted</a> after the log files are 434 moved or deleted so that it will open new log files.</p> 435 436 <p>By using a <em>graceful</em> restart, the server can be 437 instructed to open new log files without losing any existing or 438 pending connections from clients. However, in order to 439 accomplish this, the server must continue to write to the old 440 log files while it finishes serving old requests. It is 441 therefore necessary to wait for some time after the restart 442 before doing any processing on the log files. A typical 443 scenario that simply rotates the logs and compresses the old 444 logs to save space is:</p> 445 446 <div class="example"><p><code> 447 mv access_log access_log.old<br /> 448 mv error_log error_log.old<br /> 449 apachectl graceful<br /> 450 sleep 600<br /> 451 gzip access_log.old error_log.old 452 </code></p></div> 453 454 <p>Another way to perform log rotation is using <a href="#piped">piped logs</a> as discussed in the next 455 section.</p> 456 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 457 <div class="section"> 458 <h2><a name="piped" id="piped">Piped Logs</a></h2> 459 460 461 <p>Apache httpd is capable of writing error and access log 462 files through a pipe to another process, rather than directly 463 to a file. This capability dramatically increases the 464 flexibility of logging, without adding code to the main server. 465 In order to write logs to a pipe, simply replace the filename 466 with the pipe character "<code>|</code>", followed by the name 467 of the executable which should accept log entries on its 468 standard input. Apache will start the piped-log process when 469 the server starts, and will restart it if it crashes while the 470 server is running. (This last feature is why we can refer to 471 this technique as "reliable piped logging".)</p> 472 473 <p>Piped log processes are spawned by the parent Apache httpd 474 process, and inherit the userid of that process. This means 475 that piped log programs usually run as root. It is therefore 476 very important to keep the programs simple and secure.</p> 477 478 <p>One important use of piped logs is to allow log rotation 479 without having to restart the server. The Apache HTTP Server 480 includes a simple program called <code class="program"><a href="./programs/rotatelogs.html">rotatelogs</a></code> 481 for this purpose. For example, to rotate the logs every 24 hours, you 482 can use:</p> 483 484 <div class="example"><p><code> 485 CustomLog "|/usr/local/apache/bin/rotatelogs 486 /var/log/access_log 86400" common 487 </code></p></div> 488 489 <p>Notice that quotes are used to enclose the entire command 490 that will be called for the pipe. Although these examples are 491 for the access log, the same technique can be used for the 492 error log.</p> 493 494 <p>As with conditional logging, piped logs are a very powerful 495 tool, but they should not be used where a simpler solution like 496 off-line post-processing is available.</p> 497 498 <p>By default the piped log process is spawned using a shell. 499 (usually with <code>/bin/sh -c</code>). 500 Depending on the shell specifics invocation via shell might 501 lead to an additional shell process for the lifetime of the 502 logging pipe program and signal handling problems during 503 restart.</p> 504 505 <p>Use "<code>||</code>" instead of "<code>|</code>" 506 to spawn without invoking a shell:</p> 507 508 <div class="example"><p><code> 509 # Invoke "rotatelogs" without using a shell<br /> 510 CustomLog "||/usr/local/apache/bin/rotatelogs 511 /var/log/access_log 86400" common 512 </code></p></div> 513 514 <div class="note"><h3>Windows note</h3> 515 <p>Note that on Windows, you may run into problems when running many piped 516 logger processes, especially when HTTPD is running as a service. This is 517 caused by running out of desktop heap space. The desktop heap space given 518 to each service is specified by the third argument to the 519 <code>SharedSection</code> parameter in the 520 HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager\SubSystems\Windows 521 registry value. <strong>Change this value with care</strong>; the normal 522 caveats for changing the Windows registry apply, but you might also exhaust 523 the desktop heap pool if the number is adjusted too high.</p> 524 </div> 525 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 526 <div class="section"> 527 <h2><a name="virtualhost" id="virtualhost">Virtual Hosts</a></h2> 528 529 530 <p>When running a server with many <a href="vhosts/">virtual 531 hosts</a>, there are several options for dealing with log 532 files. First, it is possible to use logs exactly as in a 533 single-host server. Simply by placing the logging directives 534 outside the <code class="directive"><a href="./mod/core.html#virtualhost"><VirtualHost></a></code> sections in the 535 main server context, it is possible to log all requests in the 536 same access log and error log. This technique does not allow 537 for easy collection of statistics on individual virtual 538 hosts.</p> 539 540 <p>If <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> 541 or <code class="directive"><a href="./mod/core.html#errorlog">ErrorLog</a></code> 542 directives are placed inside a 543 <code class="directive"><a href="./mod/core.html#virtualhost"><VirtualHost></a></code> 544 section, all requests or errors for that virtual host will be 545 logged only to the specified file. Any virtual host which does 546 not have logging directives will still have its requests sent 547 to the main server logs. This technique is very useful for a 548 small number of virtual hosts, but if the number of hosts is 549 very large, it can be complicated to manage. In addition, it 550 can often create problems with <a href="vhosts/fd-limits.html">insufficient file 551 descriptors</a>.</p> 552 553 <p>For the access log, there is a very good compromise. By 554 adding information on the virtual host to the log format 555 string, it is possible to log all hosts to the same log, and 556 later split the log into individual files. For example, 557 consider the following directives.</p> 558 559 <div class="example"><p><code> 560 LogFormat "%v %l %u %t \"%r\" %>s %b" 561 comonvhost<br /> 562 CustomLog logs/access_log comonvhost 563 </code></p></div> 564 565 <p>The <code>%v</code> is used to log the name of the virtual 566 host that is serving the request. Then a program like <a href="programs/other.html">split-logfile</a> can be used to 567 post-process the access log in order to split it into one file 568 per virtual host.</p> 569 </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div> 570 <div class="section"> 571 <h2><a name="other" id="other">Other Log Files</a></h2> 572 573 574 <table class="related"><tr><th>Related Modules</th><th>Related Directives</th></tr><tr><td><ul><li><code class="module"><a href="./mod/mod_logio.html">mod_logio</a></code></li><li><code class="module"><a href="./mod/mod_log_forensic.html">mod_log_forensic</a></code></li><li><code class="module"><a href="./mod/mod_cgi.html">mod_cgi</a></code></li><li><code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code></li><li><code class="module"><a href="./mod/mod_log_config.html">mod_log_config</a></code></li></ul></td><td><ul><li><code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code></li><li><code class="directive"><a href="./mod/mod_log_config.html#bufferedlogs">BufferedLogs</a></code></li><li><code class="directive"><a href="./mod/mod_log_forensic.html#forensiclog">ForensicLog</a></code></li><li><code class="directive"><a href="./mod/mpm_common.html#pidfile">PidFile</a></code></li><li><code class="directive"><a href="./mod/mod_rewrite.html#rewritelog">RewriteLog</a></code></li><li><code class="directive"><a href="./mod/mod_rewrite.html#rewriteloglevel">RewriteLogLevel</a></code></li><li><code class="directive"><a href="./mod/mod_cgi.html#scriptlog">ScriptLog</a></code></li><li><code class="directive"><a href="./mod/mod_cgi.html#scriptlogbuffer">ScriptLogBuffer</a></code></li><li><code class="directive"><a href="./mod/mod_cgi.html#scriptloglength">ScriptLogLength</a></code></li></ul></td></tr></table> 575 576 <h3>Logging actual bytes sent and received</h3> 577 578 579 <p><code class="module"><a href="./mod/mod_logio.html">mod_logio</a></code> adds in two additional 580 <code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code> fields 581 (%I and %O) that log the actual number of bytes received and sent 582 on the network.</p> 583 584 585 <h3>Forensic Logging</h3> 586 587 588 <p><code class="module"><a href="./mod/mod_log_forensic.html">mod_log_forensic</a></code> provides for forensic logging of 589 client requests. Logging is done before and after processing a 590 request, so the forensic log contains two log lines for each 591 request. The forensic logger is very strict with no customizations. 592 It can be an invaluable debugging and security tool.</p> 593 594 595 <h3><a name="pidfile" id="pidfile">PID File</a></h3> 596 597 598 <p>On startup, Apache httpd saves the process id of the parent 599 httpd process to the file <code>logs/httpd.pid</code>. This 600 filename can be changed with the <code class="directive"><a href="./mod/mpm_common.html#pidfile">PidFile</a></code> directive. The 601 process-id is for use by the administrator in restarting and 602 terminating the daemon by sending signals to the parent 603 process; on Windows, use the -k command line option instead. 604 For more information see the <a href="stopping.html">Stopping 605 and Restarting</a> page.</p> 606 607 608 <h3><a name="scriptlog" id="scriptlog">Script Log</a></h3> 609 610 611 <p>In order to aid in debugging, the 612 <code class="directive"><a href="./mod/mod_cgi.html#scriptlog">ScriptLog</a></code> directive 613 allows you to record the input to and output from CGI scripts. 614 This should only be used in testing - not for live servers. 615 More information is available in the <a href="mod/mod_cgi.html">mod_cgi</a> documentation.</p> 616 617 618 <h3><a name="rewritelog" id="rewritelog">Rewrite Log</a></h3> 619 620 621 <p>When using the powerful and complex features of <a href="mod/mod_rewrite.html">mod_rewrite</a>, it is almost 622 always necessary to use the <code class="directive"><a href="./mod/mod_rewrite.html#rewritelog">RewriteLog</a></code> to help 623 in debugging. This log file produces a detailed analysis of how 624 the rewriting engine transforms requests. The level of detail 625 is controlled by the <code class="directive"><a href="./mod/mod_rewrite.html#rewriteloglevel">RewriteLogLevel</a></code> directive.</p> 626 627 </div></div> 628 <div class="bottomlang"> 629 <p><span>Available Languages: </span><a href="./en/logs.html" title="English"> en </a> | 630 <a href="./fr/logs.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | 631 <a href="./ja/logs.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | 632 <a href="./ko/logs.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | 633 <a href="./tr/logs.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> 634 </div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> 635 <script type="text/javascript"><!--//--><![CDATA[//><!-- 636 var comments_shortname = 'httpd'; 637 var comments_identifier = 'http://httpd.apache.org/docs/2.2/logs.html'; 638 (function(w, d) { 639 if (w.location.hostname.toLowerCase() == "httpd.apache.org") { 640 d.write('<div id="comments_thread"><\/div>'); 641 var s = d.createElement('script'); 642 s.type = 'text/javascript'; 643 s.async = true; 644 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; 645 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); 646 } 647 else { 648 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); 649 } 650 })(window, document); 651 //--><!]]></script></div><div id="footer"> 652 <p class="apache">Copyright 2017 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> 653 <p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- 654 if (typeof(prettyPrint) !== 'undefined') { 655 prettyPrint(); 656 } 657 //--><!]]></script> 658 </body></html>