My recommendation: don't log it locally. There are several Apache logging modules that will let you log things remotely, and they typically will handle the buffering on the client and server side to make sure that Apache doesn't slow down as a result of log writing lag. Not always, but mostly. ;)
You could probably also log to Syslog and have it write those logs to a remote Syslog server rather than writing them locally. That won't require a network-aware logging module. Both of those solutions have the added advantage of allowing you to log multiple webservers' logs to a single physical machine and log, making it easier to analyze them later. I haven't used it recently, but mod_log_spread worked pretty well (although be careful how you configure it - it's designed to avoid losing logs, which is good, but it also means if the client can't write the logs for some reason - IO contention, full disk, etc. - Apache will stop serving pages until the client catches up! I believe you can configure that behavior away if you want, and you can have multiple writers (I think)). http://www.backhand.org/mod_log_spread/ <http://www.backhand.org/mod_log_spread/>Of course, just pointing apache logs to syslog to a remote server is the easiest and fastest solution, but you can lose logs that way, which may be a deal-breaker depending on the use case. Another solution would be to log to a mounted ram-disk, and then just rotate your logs onto physical disk using logrotate or something similar. Another other solution: log them on something else. If you have a load balancer or proxy in front of them, log it there, and let your webservers serve pages without logging, which is what they like to do. :) You also might play w/ filesystem mount options; turn on noatime, for instance, if you don't already. Nicholas On Wed, Dec 23, 2009 at 7:11 PM, Mathew Snyder <[email protected]>wrote: > A friend asked an interesting question. He was telling me about how > his Apache logs are nailing his hard drive and was wondering if there > is a way for syslog to cache log data before writing it to disk. There > are methods such as ramlog which will create a ramdisk at startup and > then mount it at /var/log only writing to disk at system shutdown. > This would be a kludgy solution as it would require a cron job to shut > down the service before it became full forcing it to write the log > data to disk and then restarting it. There are too many variables in > that solution. > > Does syslog or syslog-ng have such an option? I Googled around but > came up empty. > > -Mathew > _______________________________________________ > Tech mailing list > [email protected] > http://lopsa.org/cgi-bin/mailman/listinfo/tech > This list provided by the League of Professional System Administrators > http://lopsa.org/ >
_______________________________________________ Tech mailing list [email protected] http://lopsa.org/cgi-bin/mailman/listinfo/tech This list provided by the League of Professional System Administrators http://lopsa.org/
