< Previous Page Return to Title Page Next Page >

Instrumenting Apache for external log monitors

  • Apache is one of the few common daemons that does not (normally) use syslogd for logging

  •  
  • However, Apache does allow piped logs (usually used for log rotation)

  •  
  • Like syslogd, Apache runs piped logging applications as root. Use secure programming practices! Careful input validation and/or "tainting" recommended.

  •  
  • Unlike syslogd, Apache starts piped logging applications immediately, not on first message.

  •  
  • If the application at the other end of the pipe terminates, Apache will restart it when the next message arrives

  •  
  • To avoid problems with different log formats, use a custom log format. Or, use the error log, whose format is almost fixed. (Caveat: HostNameLookups does affect the error log format.)