Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 4 Nov 2001 05:53:11 +0000 (GMT)
From:      Mark Hughes <mh_lists@digitalspy.co.uk>
To:        brain_damaged <brain_damaged@florida-wireless.com>
Cc:        <freebsd-questions@FreeBSD.ORG>
Subject:   Re: httpd log files big 
Message-ID:  <Pine.LNX.4.33.0111040547290.948-100000@www.digitalspy.co.uk>
In-Reply-To: <200111040049.AA3553034428@florida-wireless.com>

next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 4 Nov 2001, brain_damaged wrote:

> Hello
> I noticed that my / was full.
> I could not understand why and noticed that under
> /var/log that my httpd-access and httpd-error logs are over 8 megs big.
> I am running apache 3.1.9
> I am not sure were to setup a log rotation for it so that they don't get that big.
> how do I do that or can I ?

Sounds like nimda's doing. I came to my log files the other day on my
machine attached to my DSL line, and they'd shot up to 25MB - which is
ridiculous given that the web server itself has probably done less that
100 hits since June.

It is possible to set up a log rotation script - i'm not sure of the
"correct" way of doing it, but what I'd do would be to run a nightly or
weekly cron job which called a script that:

1) copied and gzip'd the old log files to an archive location
2) touch'd new logfiles
3) restarted apache to get it using the new log files.

Shouldn't be too challenging to write a script to do that.

> And does anyone have a perl script or program to read the httpd logs and pull out failed access or something to auto notify of virus attacks or such ?

I think there is a couple of apache perl modules called Apache::CodeRed
and Apache::Nimda - available from http://acadia.ne.mediaone.net/Nimda/

Hope this helps.
Mark

--
Mark Hughes - DVD & Film Content Manager, Technical Officer
Digital Spy Ltd
http://www.digitalspy.co.uk/
Your number one source for digital media and entertainment news!



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.LNX.4.33.0111040547290.948-100000>