2

I have a LAMP server where logrotate does its job once per week, and I notice some logs tend to get quite large. For example, the apache access-log is 73MB. Is it better that I tell logrotate to rotate it daily? Does size matter for the performance (cpu load) or are we talking marginal differences (daily vs weekly rotation)?

The file system is ext3.

Improve this question

4 Answers 4

Reset to default
3

I've never seen any apache webserver whose performance was affected by log file size. On some very old servers, apache would just stop working if log file reaches 2GB.

73MB is small.

Deciding to rotate webserver log file daily is convenient (readability, easier to combine with tools like awstats, ...)

Improve this answer
3
  • Ok I see your point. What if there are hundreds of apache vhosts each generating "large" files? Wouldn't a lot of disk i/o affect the performance?
    – charly gordon
    Oct 9, 2012 at 14:53
  • In theory yes. But you would have many other problems before : cpu and ram to handle the requests, bandwidth, ...
    – user130370
    Oct 9, 2012 at 14:57
  • If that was a concern you could send access logs for all vhosts to a single access log, and split the logs out into their individual virtual hosts later on at your convenience, or on a different host, etc.
    – Stefan Lasiewski
    Dec 17, 2012 at 17:28
2

Considering you can buy hard drives with capacities of 4,000,000 MB; a 73MB log file is pretty small really. I would let logrotate rotate the file once a day, keep a week to a month around for various analysis. It doesn't make any noticable difference to the rest of the server (CPU, RAM, etc) at that size.

Improve this answer
1

Never measured it, but I think log size has low impact on performance. If you have BufferedLogs turned on, it takes some memory, otherwise it's only sequential writes to disk. If your apache makes many random disk accesses (serving many images or whatnot) try external log server to minimize iowait for log write. Also with debug logging level log grows very fast, if it's not important, change to info. Cheers

Improve this answer
1

In most cases (when you just append data to the end of the log file), it doesn't matter how large the file is (gotten it to a couple 10s of gig's on a 512mb ram machine, with no visible slowdowns, until the /var partition was full :))

If your /var partition is small, your log files large (73MB is relatively small), or you need daily logs for archival/processing, you should use daily rotation. If you dont process logs, or don't do anything with them, except append data to the end (like apache does), it doesnt matter how often your rotate them - just take care not to use up all the space on /var, since it can cause bigger problems then just not-having logs.

Improve this answer
1
  • Do note that if you need to grep for, say, some suspicious IP addresses in your access_log, that will take significantly longer in a 60 GB log file than a 25 MB one.
    – jgoldschrafe
    Oct 9, 2012 at 14:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .