How to Split lighttpd Logs With vlogger in Debian Etch

Vlogger is a little piece of code borned to handle dealing with large amounts of virtualhost logs. It’s bad news that apache can’t do this on its own. Vlogger takes piped input from apache, splits it off to separate files based on the first field. It uses a file handle cache so it can’t run out of file descriptors. It will also start a new logfile every night at midnight, and maintain a symlink to the most recent file. For security, it can drop privileges and do a chroot to the logs directory.

we need to put just one accesslog.filename directive into our global lighttpd configuration, and it will write access logs for each virtual host and day. Therefore, you do not have to split lighttpd’s overall access log into access logs for each virtual host each day, and you do not have to configure lighttpd to write one access log per virtual host

Install vlogger in debian etch

aptitude install vlogger

This will complete the installation

First you need to make sure you have working lighttpd server

Configuring vlogger

Now we have to modify the accesslog.filename line in /etc/lighttpd/lighttpd.conf and add an accesslog.format line that works with vlogger

#vi /etc/lighttpd/lighttpd.conf

#### accesslog module
accesslog.filename = “| /usr/sbin/vlogger -s access.log /var/log/lighttpd”
accesslog.format = “%v %h %V %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\””

save and exit the file

NOTE :- You have to disable all other accesslog.filename and accesslog.format directives in your lighttpd configuration.Mainly for virtual hosts

Now restart lighttpd using the following command

#/etc/init.d/lighttpd restart

Vlogger will now create subdirectories in the /var/log/lighttpd directory, one per virtual host, and it will create access logs that contain the current date in the file name. It will also create a symlink called access.log that points to the current log file.

Let’s assume we have two virtual hosts, and Then this is how the /var/log/lighttpd directory will look like:

access.log -> 02122008-access.log
access.log -> 02122008-access.log

Vlogger man page as follows

To use vlogger, you need to add a “%v” to the first part of your LogFormat:

LogFormat “%v %h %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”” combined

Then call it from a customlog:

CustomLog “| /usr/sbin/vlogger -s access.log -u www-logs -g www-logs /var/log/lighttpd” combined

Options are given in short format on the command line.

-a Do not autoflush files. This may improve performance but may break logfile analyzers that depend on full entries in the logs.

-e ErrorLog mode. In this mode, the host parsing is disabled, and the file is written out using the template under the specified LOGDIR.

-n Disables rotation. This option disables rotation altogether.

-f MAXFILES Maximum number of filehandles to keep open. Defaults to 100. Setting this value too high may result in the system running out of file descriptors. Setting it too low may affect performance.

-u UID Change user to UID when running as root.

-g GID Change group to GID when running as root.

-t TEMPLATE Filename template using Date::Format codes. Default is “%m%d%Y-access.log”, or “%m%d%Y-error.log”. When using the -r option, the default becomes “%m%d%Y-%T-access.log” or “%m%d%Y-%T-error.log”.

-s SYMLINK Specifies the name of a symlink to the current file.

-r SIZE Rotate files when they reach SIZE. SIZE is given in bytes.

-d CONFIG Use the DBI usage tracker.

-h Displays help.

-v Prints version information.

Sponsored Link

Leave a comment

Your email address will not be published. Required fields are marked *