apache log folders - re-creation?

  • I have millions of zipped apache logs in /var/log/apache2/*/
    Is it possible to rename (archive) the complete folder /var/log/apache2 and re-create the folder struture?


    system details:
    imscp v. 1.1.2
    squeeze
    PHP 5.3.x

  • Hello ;


    For each site, you should have a directory such as /var/log/apache2/<site_log_dir> in which the log files are stored. The logs files are rotated every days and the last 365 log archives are keep for EU law reasons.


    If you want, you can backup all current logs (create an archive of the /var/log/apache2 directory), store it on another server and then, run the i-MSCP setup script to re-create the logs structure.


    However, normally, you shouldn't do such a thing. Each directory have two log files. Thus, you should have 365 * 2 = 730 archives max per directory. The log files are daily rotated for performance reasons but you can change that by modifying the /etc/logrotate.d/apache2 file. For instance, to have only one archive per week (per log file):


    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

  • thanks, do you think processing (time and load during find) of apache logs fex. fail2ban can be improved when moving older files out of /var/log/apache2/*/ from time to time?

  • Re ;


    The current logs folder structure has been thinked for fail2ban. Fail2ban parses the plain log files only. It doesn't parses the archived log files. The log files are daily rotated specially for fail2ban. Eg, if the log files are weekly rotated, fail2ban will have more data to parse when you will restart it. Fail2ban uses a glob pattern to find the log files inside each directory, which is really cheap. This is like if you type the # ls /var/log/apache2/*/access.log command manually. As you can see, This is really fast and cheap in term of resource consumption. The resource consumption is more due to the parsing of those log files.


    If you want mitigate the resource consumption, you should simply consider to change the value of the findtime parameters in you fail2ban conffile.

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

  • Re;


    If you don't like see all those archives in the production log directories, you can maybe also give a try to the logrotate olddir option. I've never tried it but as I understand, this allow you to store archived log files in another directory. I must try it. See man logrotate.

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

  • Re ;
    The current logs folder structure has been thinked for fail2ban. Fail2ban parses the plain log files only. It doesn't parses the archived log files.


    I just have one question to the main error.log :)
    what about /var/log/apache2/error.log ?
    could this work with fail2ban too instead of the wildcard definition
    /var/log/apache2/*/error.log

  • Hello ;


    NO NO NO NO NO

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206