Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a small VPS that a friend and I use to host a few websites. We are both relatively inexperienced with server management and are unsure of an effective way to deal with the logs that Apache generates.

Each site generates it's own log file in a directory structure similar to the one below:

/var/www/{user]/{sitename}/logs

The problem is that some of these are getting quite large (300mb). I am considering installing logrotate to help deal with this size problem. However I am unsure of an effective way to deal with the logs since these are not critical sites and thus the logs in my opinion aren't that important.

What are recommended practices for working with logs? and what is your advice/opinions on such matters?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Logrotate is definetly the way to go. Since the logs are growing in size you can use logrotate to significantly compress the logs. Assuming your using apache modify the following

vi /etc/logrotate.d/httpd

You'll want it to look something like this:

"/var/log/httpd/site1/*.log" "/var/log/httpd/site2/*.log" {
weekly
rotate 7
compress
missingok
notifempty
sharedscripts
postrotate
/sbin/service httpd reload > /dev/null 2>/dev/null || true
endscript
}
  • Weekly: Log files are rotated if the current weekday is less then the weekday of the last rotation or if more then a week has passed since the last rotation.
  • Rotate 7: Log files are rotated 52 times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather then rotated.
  • Compress: Old versions of log files are compressed with gzip to save disk space.
  • Missingok: If the log file is missing, go on to the next one without issuing an error message.
  • Notifempty: Do not rotate the log if it is empty
  • Sharedscripts: Normally, prerotate and postrotate scripts are run for each log which is rotated, meaning that a single script may be run multiple times for log file entries which match multiple files. If sharedscript is specified, the scripts are only run once, no matter how many logs match the wildcarded pattern. However, if none of the logs in the pattern require rotating, the scripts will not be run at all.
  • Postrotate /sbin/service httpd reload > /dev/null 2>/dev/null || true
  • Endscript: The lines between postrotate and endscript (both of which must appear on lines by themselves) are executed after the log file is rotated. These directives may only appear inside a log file definition.

EDIT: As Lucas Mentioned: Another thing you might want to check out is why your logs are filling up. This can point you to some bad code, or perhaps someone trying to do something malicious, ie via forms etc

If you need more info on the options just use

man logrotate

share|improve this answer
    
Would I have to have an entry for each folder? as my apache logs are located in diff folders for each site or can I specify this in a single entry? e.g. pastebin.com/A6Ej1JNS –  Malachi Apr 24 '12 at 19:34
1  
Edited my post for what you need –  RomeNYRR Apr 24 '12 at 19:54
    
Thanks - that is exactly what I need. I am going to test it on one of my websites and push the others in once I've got a configuration I am happy with :) –  Malachi Apr 24 '12 at 20:03
    
You're welcome :) –  RomeNYRR Apr 24 '12 at 20:07
    
So I have followed your advice and setup the file like such: pastebin.com/n27J44R4 However I am not seeing a weekly rotation of logs. I have tested this by forcing and get this output. pastebin.com/RrvK8mt9 –  Malachi May 9 '12 at 20:10

I would indeed use logrotate, your 300 MB will turn into a mere 8 MB after compressing. You can also script it so you can backup the compressed logs to a remote server (or some other backup drive) every once in a while and then delete those logs.

If the sites are not critical you can discard the logs after a while (it's up to you to decide when you think they aren't useful anymore).

Another thing you might want to check out is why your logs are filling up. There might be some warnings in your code that can easily be fixed or are just unnecessary debug information.

share|improve this answer
    
Thanks for the advice :) –  Malachi Apr 24 '12 at 19:04
    
Say I found malicious looking activities in my log... e.g. people scanning for vunrabilities... How would you recommend dealing with this? or does this warrant a second question? –  Malachi Apr 24 '12 at 19:21
1  
I think a second question is apropriate, but post it on security.stackexchange.com –  Lucas Kauffman Apr 24 '12 at 20:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.