Apache Log Rotation

Apache logs keep growing so it is vital to have a strategy to get the log files off the web server and processed.

Using cron is perhaps the best way to achieve this though I will outline the manual steps first. As access to the server is generally over a secure link, expect will introduce some security considerations.

Step One - Identify Location of Logs

Log files are normally kept on the var paritition under the log/ directory, Depending upon the installation the files will be labeled httpd-access.log, or under an apache directory and labeled access.log. These are the defaults but sites are free to specify any loaction or name for the log files. The apache configuration files are the definitive source, for identifying the log file location.

# locate access
# find /var/ -name '*access*' -print
# grep log /etc/apache/httpd.conf

Step Two - Move, Restart, Wait and Compress

Once the log location is found, the log files need to renamed. Apache needs to be restarted and a period of waiting should occur as Apache will keep a handle to the log files (even after rename) for any current connections. It is then safer to to compress the log files.

I use a numbering system to achieve this leaving the last rotated logs on the server to aid as backup and to allow easy knowledge of the last number used.

# mv httpd-access.log httpd-access.log.1
# mv httpd-error.log httpd-error.log.1
# apachectl graceful
# sleep 600
# gzip httpd-access.log.1 httpd-error.log.1

Step Three - Get the Log Files to Processing Host

I would advise the use of SSH to achieve this, namely scp in the SSH suite of tools. The command is run from the processing host.

$ cd ~/logs
$ scp webuser@domain.com:/var/log/httpd-access.log.1 ./
$ scp webuser@domain.com:/var/log/httpd-error.log.1 ./

Step Four - Analyse Logs

The files are now local to your processing host, all that is left is to fire up your favourite Apache log file analyser. The Further References section contains links to a number of analysis tools.

A Webalizer example follows.

$ mkdir 1
$ webalizer -n poisedsolutions.com -o ./1 httpd-access.log.1.gz