You probably have something looking like this in your logrotate configuration file
"/var/log/httpd/access.log" /var/log/httpd/error.log {
rotate 5
size=100k
sharedscripts
postrotate
/sbin/killall -HUP httpd
endscript
}
rotate 5 means that only last 5 files will be keept. Here file are turned every 100k.
if you have the daily keyword it means that each archived file is 1 day of log. If you want to keep file longer on the server you have to increase the rotate value
See http://httpd.apache.org/docs/2.2/logs.html#virtualhost
If CustomLog or ErrorLog directives are placed inside a section, all requests or errors for that virtual host will be logged only to the specified file. Any virtual host which does not have logging directives will still have its requests sent to the main server logs.
In other words, if you place Logging directives within a VirtualHost section, it will override the Logging directives within the main server configuration. If you want to log to a single logfile, then remove the log configuration from your VirtualHost sections.
For simplicity, I prefer to log all Access data to a single logfile. Later, you can process the logs and split the logfiles into logfiles for the Virtual Hosts. Also, writing to a single logfile is a more efficient use of computer resources then writing to 30 logfiles at once. Just make sure your LogFormat includes the '%v', which will log the name of the Virtual Host.
Is it possible to have ALL accesses and errors duplicated to a shared logfile?
You can log all errors and access to a shared logfile, but the logfile is ugly. First, send the Apache log data to syslog, and then use syslog to send to a local file or a remote log server.
# Send access logs to syslog
LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog "|/usr/bin/logger -t httpd -i -p local7.notice" combined
# Send error logs to syslog
ErrorLog syslog:local7
And then in /etc/syslog.conf
# Send all HTTP log data to this file
local7.* /var/log/http-all.log
Best Answer
You might want to explain what your requirements and limitations are in more detail if you're looking for a solution to a particular problem. But as it stands, simply:
Nope.
Nope.
Update:
It hadn't occured to me of using
strace. But indeed, you could use it to inspect thewrite()calls.You're going to run into some difficulty though keeping track of processes. I don't think that strace's fork detection will necessarily help you. Which means that you'll be constantly running around to find which process handled a given request.
As for such a feature in Apache. That's horrible and wouldn't exist. I think you're an edge case ;)