Is there any way to intercept Apache (1 or 2) access logs to stdout without :

  • modifying the config files
  • restarting the service

Currently my apache config file specifies "CustomLog /dev/null common" System is Debian Etch.

Thanks in advance serverfault community !

EDIT : The idea would be to do what "strace -p" does with processes. I hoped apache2ctl or something would have a "dump current accesses" feature :D

  • I was thinking about rm /dev/null; ln -s /tmp/apache.log /dev/null, but that would require restarting Apache too :( – user1686 Oct 6 '09 at 12:58
  • I wonder if you can fiddle in /proc/{pid}/fd to make that change. Of course, any change control policy that forbids changing apache config without approval should abhor that sort of behavior. – jldugger Oct 6 '09 at 19:12

You might want to explain what your requirements and limitations are in more detail if you're looking for a solution to a particular problem. But as it stands, simply:

Can you intercept data going to /dev/null.


Can you tell Apache to log elsewhere without modifying it's config files or restarting the service.



It hadn't occured to me of using strace. But indeed, you could use it to inspect the write() calls.

strace -ewrite -s1000 -p<PID>

You're going to run into some difficulty though keeping track of processes. I don't think that strace's fork detection will necessarily help you. Which means that you'll be constantly running around to find which process handled a given request.

As for such a feature in Apache. That's horrible and wouldn't exist. I think you're an edge case ;)


How about changing the config files temporarily, and reloading them? You're asking to reconfigure apache, plain and simple. There's an Apache "reload" function that will use the new config without dropping active connections, if your concern is availability.

EDIT: This is the craziest thing I've ever seen: fdmess

This is a small utility to redirect file descriptors of running processes and more generally tweak them. It works by attaching with ptrace to an existing process and forcing it to execute some syscall. This way you can force a process to drop privileges, to redirect a file descriptor to a file or a tcp/ip connection, to connect a descriptor to the descriptor of another running process with a unix socket, or to set a file descriptor equal to the descriptor of another running process (unix file descriptor passing is used). Since the code hooks are architecture-dependent, at the moment only the linux-x86 and linux-x86_64 architectures are supported. Patches for other architectures are welcome.


I'm not entirely sure what you are trying to achieve, but if you are just wanting to watch the logs as they update on stdout... you can view the Apache access or error logs, in real time as they update, using the "follow" option of tail

For example

tail -f /var/log/apache2/access.log

Tail man page


Guys, how about using urlsnarf ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.