Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So, I've been using cronolog for years with this directive:

<VirtualHost *:80>
  SetEnv origin SND
  CustomLog "|/usr/bin/cronolog [..]/logs/SND/log_%Y-%m.txt" combined

Problem is that with a lot of virtual hosts, I suddenly reach my maximum of open file descriptors when apache is spawning cronolog.

With some googling (and searching here) I've found no solution for this, so is there none? As you can see, I set an ENV variable in Apache to "SND" for that vhost, what I would LIKE to do is something like this:

CustomLog "|/usr/bin/cronolog [..]/logs/${origin}/log_%Y-%m.txt" combined
<VirtualHost *:80>
   SetEnv origin SND

Which, theoretically, would spawn just one cronolog process that writes to the correct vhost log file.

But it seems that the pipe commend isn't parsed for Apache variables in any stage of the process, which means that the only solution that I can see is that I add ${origin} to the LogFormat and then write my own log rotate script that will parse out (and ignore) the vhost variable and then write the rest of the log line to the appropriate file. But will this be less overhead?

Any other suggestions?

share|improve this question

There always will be one instance of cronolog for each open log file. One solution is here: It suggests to just add vhost name to log file and then split it into separate files, if needed.

Other possible solution, that you suggested: write your own program/script that will split logging into per-vhost logs. Also it may be a good idea to send all to syslog and run splitting program on syslog host. In this way apache will hold open only one file descriptor for each log type. Naturally, there will be some overhead, but apache will not run out of file descriptors limit.

share|improve this answer

maybe you could use a named pipe.

generally gelraen's suggestion is pretty good, but if you do it you will miss the rotation (you could call cronolog from syslog, but then some extra queues may be needed in order to reduce the overhead) (taken from gelraen)

except for that, maybe it's a good time to distribute your virtual hosts. even if you cannot afford a real machine, you could use a virtual one. But i don't think that having everything on a single server is a good idea.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.