Logs and Logging
How to work with the logging facilities of the server.
Unices of all kinds are capable of producing a lot of log files, almost every process in Unix is capable of outputting a log, especially daemon processes. Which is mostly what we will be dealing with.
Nearly all logging is turned off on a standard Westhost installation and this is generally a good thing, as churning out log files can consume a fair bit of disk space. But sometimes its useful to have a log file for trouble shooting the installation, or just for checking that things are working properly. Be careful though, turn the log files on for as long as you need them, turn them off if you don’t need them. If they will stay on, then consider entering them into the logrotate configuration (see later) and maybe even mailing yourself a reminder now and then.
Logs are generally stored in /var/log and as I said, the only ones at present will probably be in /var/log/http/. A look in there will show a bunch or less of log files.
[gnomedia][~]$ cd /var/log [gnomedia][/var/log]$ ls -al httpd drwxr-xr-x 2 gnomedia vuser 4096 Oct 22 00:23 . drwx------ 3 gnomedia vuser 4096 Oct 24 01:49 .. -rw-r--r-- 1 gnomedia vuser 998997 Oct 26 13:18 accesslog -rw-r–r– 1 gnomedia vuser 95106 Oct 22 00:15 accesslog.1.gz -rw-r–r– 1 gnomedia vuser 122317 Oct 25 06:47 errorlog -rw-r–r– 1 gnomedia vuser 790642 Oct 26 13:18 refererlog -rw-r–r– 1 gnomedia vuser 89449 Oct 15 23:57 refererlog.1.gzAccesslog gives a record of file accesses, error_log gives a record of apache errors. The files ending in ‘.gz’ are the old logs, compressed to save space.
In the var/log/ directory we find a lot less:
[gnomedia][/var/log]$ ls -al total 732 drwx------ 3 gnomedia vuser 4096 Oct 24 01:49 . drwxr-xr-x 13 gnomedia vuser 4096 Oct 9 05:26 .. drwxr-xr-x 2 gnomedia vuser 4096 Oct 22 00:23 httpd -rw------- 1 gnomedia vuser 0 Oct 13 03:09 mysqld.logIf we want to turn on mail logging, we need to edit the sendmail configuration files. These are located in the /etc/mail directory, the one we are interested in is ’sendmail.cf’.
[gnomedia][/var/log]$ cd /etc/mail [gnomedia][/etc/mail]$ vi sendmail.cf
We are looking for the line:
O LogLevel=0
and change that to:
O LogLevel=9
(Do NOT change anything else!).
After sending and receiving a few emails, the results will be a new maillog:
[gnomedia][/var/log]$ ls -al /var/log total 732 drwx------ 3 gnomedia vuser 4096 Oct 24 01:49 . drwxr-xr-x 13 gnomedia vuser 4096 Oct 9 05:26 .. drwxr-xr-x 2 gnomedia vuser 4096 Oct 22 00:23 httpd -rw------- 1 gnomedia vuser 3154 Oct 26 13:07 maillog -rw------- 1 gnomedia vuser 0 Oct 13 03:09 mysqld.log
There is no real reason to keep the logging enabled, unless you are trying to fix a problem, or if you have a mail statistics program setup.
Another log file that is sometimes useful is the procmail log. This is enabled by modifying the /etc/procmailrc file.
[gnomedia][/etc/mail]$ cd /etc [gnomedia][/etc]$ vi procmailrc
And adding these two lines near the top:
LOGABSTRACT = “all”
LOGFILE = “/var/log/procmail.log”
Thats all thats needed. There will be a file /var/log/procmail.log which will give you details of how procmail is routing the emails.
MySQL Logging, this is turned on in the /etc/my.cnf file, look for the line: log = /dev/null and change it to: log = /var/log/mysqld.log There is also a MySQL error file, to found at /var/lib/mysql/mydomain.com.err, but I’m not sure what controls this.
FTP logging is enabled in the /etc/ftpaccess file, look for the line:
# log transfers anonymous,real inbound,outbound
and uncomment it. Logs will appear in /var/log/xferlog
PHP logging is already turned on in the /usr/local/lib/php.ini file, check for the entries:
logerrors = on
errorlog = /var/log/php.error
As I said at the start, log files are sometimes useful for sorting out problems, but should not necessarily be left on, as they will consume disk space. Web site statistics are always useful to have (you are running a web site, right?) so leave the http logging enabled. Sendmail logging is needed if you are keeping mail statistics and an ftp log if you are running an ftp site. Other than that, there is not so much need for the others.
On a fresh WH2 installation, I found only Apache logging and MySQL error loggin are turned on by default, although one of my sites had php logging turned on as well. All other logging is turned off. Which is probably the best…
Logrotate
One useful technique when we are dealing with log files is the ability to trim them to a manageable size, as large log files can slow down the perfomance of the applications writing them. This is where a utility called logrotate comes in handy. Logrotate is run everyday and checks the log files, and if they meet a certain criteria (usually above a cerain size or age) then they are gzip’d up and an empty log file is started. What log files are rotated and what criteria are used is found in the configuration files /etc/logrotate.conf and in the /etc/logrotate.d directory. There is also an excellent section in the Westhost online manual that details how they are defined.