Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have many virtual hosts set up on a web server, each one having its own error and access log. The relevant lines of httpd.conf are something like this:

ErrorLog /var/log/httpd-error.log
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog /var/log/httpd-access.log combined

NameVirtualHost *:80

<VirtualHost *:80>
    DocumentRoot /var/www/
    ErrorLog /var/www/
    CustomLog /var/www/ combined

# ... many more VirtualHosts

Currently, I'm getting some random errors in /var/log/httpd-error.log, but I'm getting nothing in /var/log/httpd-access.log. Is it possible to have ALL accesses and errors duplicated to a shared logfile? Is it possible to do this without adding new entries to every single VirtualHost?

share|improve this question


If CustomLog or ErrorLog directives are placed inside a section, all requests or errors for that virtual host will be logged only to the specified file. Any virtual host which does not have logging directives will still have its requests sent to the main server logs.

In other words, if you place Logging directives within a VirtualHost section, it will override the Logging directives within the main server configuration. If you want to log to a single logfile, then remove the log configuration from your VirtualHost sections.

For simplicity, I prefer to log all Access data to a single logfile. Later, you can process the logs and split the logfiles into logfiles for the Virtual Hosts. Also, writing to a single logfile is a more efficient use of computer resources then writing to 30 logfiles at once. Just make sure your LogFormat includes the '%v', which will log the name of the Virtual Host.

Is it possible to have ALL accesses and errors duplicated to a shared logfile?

You can log all errors and access to a shared logfile, but the logfile is ugly. First, send the Apache log data to syslog, and then use syslog to send to a local file or a remote log server.

# Send access logs to syslog
LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog "|/usr/bin/logger -t httpd -i -p local7.notice" combined
# Send error logs to syslog
ErrorLog syslog:local7

And then in /etc/syslog.conf

# Send all HTTP log data to this file
local7.*        /var/log/http-all.log
share|improve this answer

What I did was add a second CustomLog line in the VirtualHost section. But I had to do this for every single vhost conf file. It works and it's in my template now so new vhosts are taken car of.

My apache2 now logs hits to two places:

  1. The specifics for a vhost in that vhost's directory and
  2. to /var/log/apache2 in a combined file for all vhosts.

I apply a different LogFormat to each of these two logs to accommodate respectively, of course. The /var/log/apache2 log is parsed with Perl and sucked into a highly normalized MySQL structure for analysis and reporting. Logrotate sweeps up once a week.

share|improve this answer

I don't think this is possible. At least the documentation does not mention such thing.

Best way to simulate this sort of behaviour is to define the %v tag in the format and at log rotation split a copy of the log files to virtual host specific files.

share|improve this answer

I don't know if your log file locations follow any sort of pattern across the virtualhosts, but if they do I would forget about having Apache create a duplicate log and just cat the logs when I need them.

cat /var/www/*/log/access.log > /var/www/logs/access.log
share|improve this answer

I'm looking for an answer to this question as well. So far, I have two solutions:

  1. the cat solution joebert mentioned
  2. my own tail solution: tail -f /var/log/httpd/*access_log

I want to be able to see a tail -f sort of view into all web server activity on the host. I would much rather be able to tail just one file, however, as I don't really like the way tail handles multiple files.

share|improve this answer
Get multitail. It's pretty useful. – Till Jul 1 '10 at 17:33

You have 2 possibilities using ErrorLog directive

1) Use syslog and handle the duplication in [r]syslog.conf

2) Use pipe, send the log entry to an application/script and handle the duplication in that application/script

share|improve this answer

Is watching all access logs strictly necessary? If the errors are actually caused by a request for a vhost, there should be something logged in the vhost error log. In that case, ls -t /var/www/*/log/error.log to determine which vhost is the culprit and then watching just that access log file would seem to be a good first step to eliminate a lot of needless log reading.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.