How can I limit the size of Apache's access_log, and limit the number of archived logs it keeps?

Question

Apache's access_log file rotates out into an archived copy around 1GB every few days. Where are the settings to control this? I'd like to be able to control both the max size and the number of archived logs it keeps around. Is this part of apache's configuration, or do I need to write cron jobs ( et al ) to deal with this? I'm running pre-forked httpd.

Morganstein

What operating system does your server use? – Surah

Answer 1

On most Linux distributions, the system is set up to run logrotate on a daily basis. You won't see it in the crontab for root or for any particular user.

It's easy to change how it handles log files. On my Ubuntu server, the /etc/logrotate.conf file has settings like these:

# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

[etc.]

And, you can look in the directory /etc/logrotate.d/ to see settings for specific directories and apps.

Surah

What file should I look for to edit the log settings of virtual domains on the server? Would this be logrotate.d/apache2? – Extra

that would be inside /etc/apache2/sites-enabled – Monad

Answer 2

I would use rotatelogs, a tool located in the apache bin directory.

See http://httpd.apache.org/docs/current/programs/rotatelogs.html for more information and examples. It has the advantage to exist on my HP-UX system.

Or as mentioned previously, you can use the logrotate tool that comes with most distributions.

Eaton

Answer 3

I needed to control a size of my log files per virtual host and ended up with it:

ErrorLog "|/usr/bin/rotatelogs /var/www/my-virtual-host.com/logs/error_log_%Y.%m.%d.log 10M"

Use which rotatelogs to find a path of an executable. Im my case it was /usr/bin/rotatelogs not |bin/rotatelogs as it's described in documentation.

http://httpd.apache.org/docs/2.0/programs/rotatelogs.html

Obviously rotatelogs can be applied to access_log (ie. CustomLog) as well.

Remit

On Windows, I can use this command CustomLog "|${SRVROOT}/bin/rotatelogs.exe ${SRVROOT}/logs/access.log 1M" common where ${SRVROOT} is from Define SRVROOT "C:/wwwserver/apache24" that was added in main config file. However, the problem is some other log on virtual host did not write out. Maybe because heap space that was mentioned in their document. The log output is access.log.nnn where nnn is timestamp not access.log file name. – Christenachristendom

Answer 4

The other_vhosts_access.log logs were growing too fast and I commented out the CustomLog line in /etc/apache2/conf-available/other-vhosts-access-log.conf and it worked for me.

Thoreau

Answer 5

On Ubuntu, I had the exact opposite problem, I needed to keep more logs. However, the solution is the same.

The Apache logs are rotated by logrotate. You can edit /etc/logrotate.d/apache2 if you want to change the Apache logrotate configuration.

The logrotate tool runs according to the schedule set in your system's cron jobs and it reads the configuration files every time it runs. This means any changes you make to the config files will be picked up the next time logrotate is executed.

Number of logs

To control the number of archived logs, rotate 14 is what you are looking for, change 14 to the number of files you want to keep.

rotate [count]

Log files are rotated count times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather than rotated. If count is -1, old logs are not removed at all, except they are affected by maxage (use with caution, may waste performance and disk space).

Max size of the logs

If you want to control the maximum size, you can use size 100M.

size [size]

Log files are rotated only if they grow bigger than size bytes. If size is followed by k, the size is assumed to be in kilobytes. If M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G are all valid. This option is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time, if specified after the time criteria (the last specified option takes the precedence).

Testing

Test your configuration to make sure there are no syntax errors. The -d flag stands for debug mode, and it will show you what logrotate would do, but it won't actually rotate any logs:

sudo logrotate -d /etc/logrotate.conf

Force a log rotation. The -f flag stands for force mode, which forces the rotation even if it doesn't seem necessary according to the logrotate configuration. To apply the changes immediately and rotate the logs manually, you can run:

sudo logrotate -f /etc/logrotate.conf

Example

The default /etc/logrotate.d/apache2 on Ubuntu 22.04 looks like this:

/var/log/apache2/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 640 root adm
    sharedscripts
    prerotate
        if [ -d /etc/logrotate.d/httpd-prerotate ]; then
            run-parts /etc/logrotate.d/httpd-prerotate
        fi
    endscript
    postrotate
        if pgrep -f ^/usr/sbin/apache2 > /dev/null; then
            invoke-rc.d apache2 reload 2>&1 | logger -t apache2.logrotate
        fi
    endscript
}

Salesin

Answer 6

The customary way is to run logrotate from a cronjob, which can slice, dice, compress, rename, keep the last n and most other things one could want. (I think most distributions these days install it by default.)

Cowardice

What is causing it to rotate out into an archived copy now? I don't have any cron jobs set. I do occasionally restart httpd. Does that do it? – Morganstein