I needed to review an Apache httpd server error log file recently and even though the server had been rebooted only a month ago, I had to scroll through 95,000 lines before I got to the interesting part.
To make Apache’s log files more manageable, I configured them to roll every week using the FreeBSD standard newsyslog utility. newsyslog is run from cron, and in the default configuration runs every hour. This limits rolling logfiles to at most once an hour, but this is typically more than adequate for system log files.
I could have hacked newsyslog’s main config file /etc/newsyslog.conf, which would kept all configuration in one place for convenience. However this can lead to trouble when updating the system (because any new version would have to be manually merged with the edited old version), and keeping updating simple is generally a good idea. To deal with this, there are directives in the main config file to read additional optional configuration:
... <include> /etc/newsyslog.conf.d/* <include> /usr/local/etc/newsyslog.conf.d/*
Since the Apache server is third-party software, I created /usr/local/etc/newsyslog.conf.d/apache.conf containing the following:
# Apache /var/log/httpd-access.log www:www 440 9 * $W1D4 J /var/run/httpd.pid 30 /var/log/httpd-error.log www:www 440 9 * $W1D4 J /var/run/httpd.pid 30
To understand what this means, the fields are: [logfile name] [owner-group] [mode] [count] [size] [when] [flags] [path to pid file] [signal]. Apache’s access and error log files will be rolled every Monday at 4am (system time), a total of 9 weekly archives will be kept (providing up to 10 weeks of logs counting the current log), and log file archives will be compressed using bzip2. Some other interesting points are:
- For security, ownership of archived logs is set to www and the file mode is set to read-only for user and group, with no access by anyone else.
- A SIGUSR1 signal (30) is sent to Apache to perform a graceful restart after rolling the log file.
For more information, see the System Logging section of the FreeBSD Manual as well as the man pages for newsyslog and newsyslog.conf.
To read a compressed log file, uncompress the file and pipe to less:
% sudo bzcat httpd-error.log.0.bz2 | less
Which is also equivalent to the simpler:
% sudo bzless httpd-error.log.0.bz2