11

Apache provides a tool called rotatelogs which has the benefit of not restarting apache when rotating logs which happens with logrotate. I do not have enough experience to speak if this is enough criteria to use rotatelogs over logrotate.

My questions is does anyone have real life experience using either or of these two tools and what were your input would be?

What would you recommend and why?

Mohan Gulati
  • 211
  • 1
  • 2
  • 4

2 Answers2

7

I would recommend logrotate for most people since that is what will be rotating all the other logs (KISS: Keep it Simple Stupid). Logrotate doesn't restart all of Apache, rather it just sends it a signal that tells it to reopen all of it's log files and restart children. This signal can be SIGHUP, which causes the children to restart right away (which will interrupt downloads), or SIGUSR1, which does a graceful restart. With SIGUSR1, you have to delay the log processing until you think all the children would have died naturally. Either way, you probably want to analyze your logs, and time it for the lowest traffic period in the day or week.

Piped logs seems like it is the more powerful solution. A big advantage being that it will allow you to use a centralized logging system and take load of the web server itself. The manual itself says:

As with conditional logging, piped logs are a very powerful tool, but they should not be used where a simpler solution like off-line post-processing is available.

So apparently, don't use piped logging if you don't need it. I have used piped loging in the past as a hacky way to filter logs, and had no problem.

Kyle Brandt
  • 83,619
  • 74
  • 305
  • 448
  • The postrotate script with Apache's logrotate files is to send a SIGHUP, which causes Apache to terminate all children and restart. Any active connections at the time are terminated. – Warner Mar 08 '10 at 18:37
  • I read a comment somewhere that said graceful restart does not work very well with servers carrying a heavy load. But I really do not think there is much of an alternative. – Mohan Gulati Mar 08 '10 at 19:10
  • logrotate with SIGHUP is pretty standard. I wouldn't worry about it. – Warner Mar 08 '10 at 19:17
2

I've used both before. I found that using rotatelogs is a very useful tool in managing access logs and if you don't want apache downtime. On a high volume site I would recommend this, the only Issue I found was that if you want to manage the logs you will need to have a separate script cron'd to either clean up or move the logs to a backup server, obviously this depends on the requirement. With logrotate you do have more options with how logfiles are handled, the only issue is when logrotate runs as explained in the previous answer, you will need to restart apache.

Basically it all comes down to choice, if you need apache to running without interruptions then rotatelogs with a external cron script to manage, else logrotate will suffice. Just be sure to setup the logrotate cron not to rotate the logs when you have high traffic.

Lastly if you want to have apache log to your syslog you can always use the logger command which is on Redhat Based linuxes.

Danie
  • 1,360
  • 10
  • 12