Apache log naming conventions

Question

I run 30+ sites out of my dedicated server (running CentOS). Some of these are subdomains. I currently use this pattern as a log file naming convention, in /etc/httpd/logs:

    site_com-error_log
    site_com-access_log

    sub_site_com-error_log
    sub_site_com-access_log

Is this best practice? Is there anything I could do to improve naming my log files?

Answer 1

The naming of files is just to your personally taste however from what I can tell in your filenames your not using a rotate and therefor I'd imagine that your logs are rather large and hard to shift though.

You should look at using a rotate by X hours, or days which then changes the labeling of your filenames with the date on the front or end of the filenames.

A typical example would look something like this

LogLevel warn
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
ErrorLog "|/usr/sbin/rotatelogs -l /etc/httpd/logs/error_log.%Y-%m-%d-%H 3600"
CustomLog "|/usr/sbin/rotatelogs -l /etc/httpd/logs/access_log.%Y-%m-%d-%H 3600" combined

So personally I'd use:

date_subdomain_maindomain_error_log
date_subdomain_maindomain_access_log

Which will look like:

29-01-2013-1600_subdomain_maindomain_error_log
30-01-2013-1600_subdomain_maindomain_error_log

Or you could simply have your logs rotate every 24 hours with just the day using

 CustomLog "|/usr/sbin/rotatelogs -l /etc/httpd/logs/access_log.%d"

 28_subdomain_maindomain_error_log
 29_subdomain_maindomain_error_log
 30_subdomain_maindomain_error_log

Using the above just makes it easier to administrate and source problems faster, but again file-naming is down to personal taste and realistically there is no better answer than your own :P

To find out more about rotating logs check out: rotatelogs

Answer 2

For nicer sorting, you could start with the TLD, followed by second-level, followed by third-level, etc.:

com-example
com-example-sub
net-example-sub-sub
net-example-www

This way all subdomains of a specific domain are "grouped" together.

Answer 3

Although im not "official source", I've experimented in this case of using a period and treating .error_log (or .error.log) like a file extension. In the case you were viewing them in some sort of "GUI" this would allow you to sort by extension more easily. Also this may lean towards dis-allowing the _ in error_log from becoming a space in some tools.

As far as the beginning of the string goes, your thoughts are valid, but again for sorting/search purposes, perhaps you could include a www on the ones without subs. This would sort a bit better since alphabetical order would then put all the top level www in a bunch. Easier to grep quickly too then to just see www's.

Indeed both of these go against the grain of how Apache log files normally are named, and may not address your requirements, but for the sake of completeness its a tactic. Hope that helps!