Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have setup separated error logs for Apache virtualhosts. when I checked some logs lately, I found entries of other unrelated programs in virtualhost logs.

for example I get entries like this in /home/user1/domain1.com/logs/error_log:

Oct  2 22:09:16 server1 procmail[15394]: Couldn't rename bogus "/var/mail/nobody" into "/var/mail/BOGUS.nobody.5CoE"
Oct  2 22:09:16 server1 procmail[15393]: Couldn't rename bogus "/var/mail/nobody" into "/var/mail/BOGUS.nobody.5CoE"
Oct  2 22:09:16 server1 postfix/local[15187]: 362D216843F: to=<root@server1.domain.com>, relay=local, delay=129, delays=0.06/113/0/16, dsn=5.2.0, status=bounced (can't create user output file. Command output: procmail: Renaming bogus mailbox "/var/mail/nobody" info "/var/mail/BOGUS.nobody.5CoE" procmail: Couldn't create "/var/mail/nobody" )
Oct  2 22:09:16 server1 postfix/local[15265]: 362F2168442: to=<root@server1.domain.com>, relay=local, delay=129, delays=0.06/113/0/16, dsn=5.2.0, status=bounced (can't create user output file. Command output: procmail: Renaming bogus mailbox "/var/mail/nobody" info "/var/mail/BOGUS.nobody.5CoE" procmail: Couldn't create "/var/mail/nobody" )
Oct  2 22:09:16 server1 postfix/qmgr[3316]: 362F2168442: removed
Oct  2 22:09:16 server1 postfix/qmgr[3316]: 362D216843F: removed
Oct  2 22:09:27 server1 webmin[15397]: Successful login as user from ip.add.re.ss
Oct  2 22:10:01 server1 crond[15443]: (user) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)

Why are these entries in Apache logs? How can I fix them?

share|improve this question

1 Answer 1

Your output looks like the output from syslogd, it doesnt look like apache's error_log, here is what apache's error log looks like:

[Tue Oct 02 15:03:55 2012] [notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
[Tue Oct 02 15:03:55 2012] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue Oct 02 15:03:55 2012] [notice] Digest: generating secret for digest authentication ...
[Tue Oct 02 15:03:55 2012] [notice] Digest: done
[Tue Oct 02 15:03:56 2012] [notice] Apache/2.2.15 (Unix) DAV/2 PHP/5.3.3 mod_ssl/2.2.15 OpenSSL/1.0.0-fips configured -- resuming normal operations
[Tue Oct 02 15:03:58 2012] [notice] caught SIGTERM, shutting down

* UPDATE *

you need to take a look at your respective httpd.conf (or similar) and make sure that your virtual host(s) are indeed uses that file to write logs.

also take a look at your syslogd configuration as it's possible that it uses same file to write logs too.

share|improve this answer
1  
Agreed. User9723489, check your VHOSTS and main configuration file an ddouble check that /home/user1/domain1.com/logs/error_log is actually set up as the Apache error log. THen check to make sure that file is not actually a symlink to something else. –  Safado Oct 2 '12 at 19:06
    
exactly! these are not Apache entries. but they are in the Apache log file (virtualhost log). that's what I'm trying to figure out. it's also a regular file not a symlink. –  yaser Oct 2 '12 at 19:10
    
the virtualhost does use the same file. I can see entries related to the virtualhost among the mentioned unrelated entries. for instance "File does not exist" entries. also it's not only this file containing posfix entries, all the other virtualhost logs have unrelated entries as well. –  yaser Oct 2 '12 at 19:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.