Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a LAMP server where logrotate does its job once per week, and I notice some logs tend to get quite large. For example, the apache access-log is 73MB. Is it better that I tell logrotate to rotate it daily? Does size matter for the performance (cpu load) or are we talking marginal differences (daily vs weekly rotation)?

The file system is ext3.

share|improve this question

4 Answers 4

up vote 3 down vote accepted

I've never seen any apache webserver whose performance was affected by log file size. On some very old servers, apache would just stop working if log file reaches 2GB.

73MB is small.

Deciding to rotate webserver log file daily is convenient (readability, easier to combine with tools like awstats, ...)

share|improve this answer
    
Ok I see your point. What if there are hundreds of apache vhosts each generating "large" files? Wouldn't a lot of disk i/o affect the performance? –  charly gordon Oct 9 '12 at 14:53
    
In theory yes. But you would have many other problems before : cpu and ram to handle the requests, bandwidth, ... –  coincoin Oct 9 '12 at 14:57
    
If that was a concern you could send access logs for all vhosts to a single access log, and split the logs out into their individual virtual hosts later on at your convenience, or on a different host, etc. –  Stefan Lasiewski Dec 17 '12 at 17:28

In most cases (when you just append data to the end of the log file), it doesn't matter how large the file is (gotten it to a couple 10s of gig's on a 512mb ram machine, with no visible slowdowns, until the /var partition was full :))

If your /var partition is small, your log files large (73MB is relatively small), or you need daily logs for archival/processing, you should use daily rotation. If you dont process logs, or don't do anything with them, except append data to the end (like apache does), it doesnt matter how often your rotate them - just take care not to use up all the space on /var, since it can cause bigger problems then just not-having logs.

share|improve this answer
    
Do note that if you need to grep for, say, some suspicious IP addresses in your access_log, that will take significantly longer in a 60 GB log file than a 25 MB one. –  jgoldschrafe Oct 9 '12 at 14:59

Considering you can buy hard drives with capacities of 4,000,000 MB; a 73MB log file is pretty small really. I would let logrotate rotate the file once a day, keep a week to a month around for various analysis. It doesn't make any noticable difference to the rest of the server (CPU, RAM, etc) at that size.

share|improve this answer

Never measured it, but I think log size has low impact on performance. If you have BufferedLogs turned on, it takes some memory, otherwise it's only sequential writes to disk. If your apache makes many random disk accesses (serving many images or whatnot) try external log server to minimize iowait for log write. Also with debug logging level log grows very fast, if it's not important, change to info. Cheers

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.