I have a Windows Server 2008 running Apache, and it will be hosting several virtual hosts.

I'd rather not use the logrotate tool (|bin/logrotate), as it seems create significant extra overhead with all the processes.

Is there a simple Windows alternative to get the log entries from a combined log file split into several per-site files? Preferably with custom output directories, but that is optional.

  • 2
    Wouldn't it be easier to just have Apache create separate logs for each vhost? It's much easier and less work to combine individual vhost logs than it is to separate out log entries by vhost from a single combined log. Commented May 31, 2012 at 1:44

1 Answer 1


Quoting directly from Apache 1.3 documentation on Log Files, this issue is addressed very nicely:

When running a server with many virtual hosts, there are several options for dealing with log files. First, it is possible to use logs exactly as in a single-host server. Simply by placing the logging directives outside the sections in the main server context, it is possible to log all requests in the same access log and error log. This technique does not allow for easy collection of statistics on individual virtual hosts.

If CustomLog or ErrorLog directives are placed inside a section, all requests or errors for that virtual host will be logged only to the specified file. Any virtual host which does not have logging directives will still have its requests sent to the main server logs. This technique is very useful for a small number of virtual hosts, but if the number of hosts is very large, it can be complicated to manage. In addition, it can often create problems with insufficient file descriptors.

For the access log, there is a very good compromise. By adding information on the virtual host to the log format string, it is possible to log all hosts to the same log, and later split the log into individual files. For example, consider the following directives.

LogFormat "%v %l %u %t \"%r\" %>s %b" comonvhost
CustomLog logs/access_log comonvhost

The %v is used to log the name of the virtual host that is serving the request. Then a program like split-logfile can be used to post-process the access log in order to split it into one file per virtual host.

Unfortunately, no similar technique is available for the error log, so you must choose between mixing all virtual hosts in the same error log and using one error log per virtual host.

Key points:

  • split-logfile is a program that can split the access log for you.
  • The error.log is either-or. You can't write it to a separate file and the combined file, while also adding an easy to see identifier.


My answer addresses splitting the logs by virtualhost, but not periodic log rotation, which may not be possible on Windows without stopping and starting apache. See comments below.

  • Apart from the fact that split-logfile doesn't seem to ship with Apache on Windows, and reports are that the pearl script version of it doesn't work reliably with pipes on Windows.
    – Cylindric
    Commented Apr 30, 2012 at 16:22
  • The document suggests a way to separate the log files, one per virtualhost. Read the "If CustomLog or ErrorLog directives are placed inside a section..." part. I think this is the better solution, because you do not have to run a log splitting tool at all. If you've got a lot of virtualhosts with a lot of logging activity, it's definitely better, because you won't have to periodically reread a large, unified log. Commented Apr 30, 2012 at 20:37
  • Sorry, yes I should've made that clearer - I can split into per-site logs fine, but I don't agree with your "you do not have to run a log splitting tool at all" comment. That implies each site's log files will become huge over time, as they'll never be split by date or rotated out.
    – Cylindric
    Commented Apr 30, 2012 at 22:02
  • Ah, interesting. I see the problem. I'm not sure a third-party program can achieve this without either: cycling apache (stop, perform log rotation ops, start); or: asking apache to temporarily yield the log file locks by closing the filehandle (an option which I don't believe apache provides). NTFS prevents other processes from anything other than read only access to a file opened for writing by apache. Many linux filesystems do not have this restriction, which I believe is why logrotate works well there. With lots of virtualhosts, cycling sounds painful. Sorry. Commented Apr 30, 2012 at 23:38
  • Yeah, a thorny problem. At the moment I don't think we'll have too many vHosts, so I might have to just suck up the overhead of a cmd process for each apache process. We've had to move back to a Linux platform for now anyway (not that that's a problem) as it turns out our Windows cloud provider doesn't support IPv6 yet :(
    – Cylindric
    Commented May 1, 2012 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.