Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to intercept Apache (1 or 2) access logs to stdout without :

  • modifying the config files
  • restarting the service

Currently my apache config file specifies "CustomLog /dev/null common" System is Debian Etch.

Thanks in advance serverfault community !

EDIT : The idea would be to do what "strace -p" does with processes. I hoped apache2ctl or something would have a "dump current accesses" feature :D

share|improve this question
I was thinking about rm /dev/null; ln -s /tmp/apache.log /dev/null, but that would require restarting Apache too :( – grawity Oct 6 '09 at 12:58
I wonder if you can fiddle in /proc/{pid}/fd to make that change. Of course, any change control policy that forbids changing apache config without approval should abhor that sort of behavior. – jldugger Oct 6 '09 at 19:12

You might want to explain what your requirements and limitations are in more detail if you're looking for a solution to a particular problem. But as it stands, simply:

Can you intercept data going to /dev/null.


Can you tell Apache to log elsewhere without modifying it's config files or restarting the service.



It hadn't occured to me of using strace. But indeed, you could use it to inspect the write() calls.

strace -ewrite -s1000 -p<PID>

You're going to run into some difficulty though keeping track of processes. I don't think that strace's fork detection will necessarily help you. Which means that you'll be constantly running around to find which process handled a given request.

As for such a feature in Apache. That's horrible and wouldn't exist. I think you're an edge case ;)

share|improve this answer

How about changing the config files temporarily, and reloading them? You're asking to reconfigure apache, plain and simple. There's an Apache "reload" function that will use the new config without dropping active connections, if your concern is availability.

EDIT: This is the craziest thing I've ever seen: fdmess

This is a small utility to redirect file descriptors of running processes and more generally tweak them. It works by attaching with ptrace to an existing process and forcing it to execute some syscall. This way you can force a process to drop privileges, to redirect a file descriptor to a file or a tcp/ip connection, to connect a descriptor to the descriptor of another running process with a unix socket, or to set a file descriptor equal to the descriptor of another running process (unix file descriptor passing is used). Since the code hooks are architecture-dependent, at the moment only the linux-x86 and linux-x86_64 architectures are supported. Patches for other architectures are welcome.

share|improve this answer

I'm not entirely sure what you are trying to achieve, but if you are just wanting to watch the logs as they update on stdout... you can view the Apache access or error logs, in real time as they update, using the "follow" option of tail

For example

tail -f /var/log/apache2/access.log

Tail man page

share|improve this answer
up vote 0 down vote accepted

Guys, how about using urlsnarf ?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.