Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

At my webserver, I have separate logfiles for all my over 250 domains.

Is this showing the server down? Would it be faster to have only one logfile that contains all access-logs?

share|improve this question

migrated from security.stackexchange.com Apr 30 '13 at 12:18

This question came from our site for Information security professionals.

3  
How is this related to IT Security? Maybe Server Fault, or Webmasters would be better suited for this question? Also, it would probably be easier to simply try it than to speculate on it. If you can't move your current logs, then you could create additional ones first as a direct copy of existing ones, then as a single file of all your domains, and run some benchmarks in between two tests then compare. Whichever turns out to be faster, holds the key to your answer then. –  Noordung Apr 30 '13 at 8:27
    
I thought, this is a place to ask questions, if someone has done this already. If not, sure, then I will start some benchmarks myself, but why reinvent the wheel? Why the downvote? If this fits better to Server Fault, couldn't you just move this question there instead of downvoting? –  rubo77 Apr 30 '13 at 8:42
    
As per FAQ, your question is off topic. If your question doesn't have a duplicate on the websites I mentioned in my previous comment, then it will be moved there (whichever of the two it fits better) by moderators. Voting usually reverses once the question finds its proper place (answerers tend to upvote questions they give answers to, others can upvote it too if they find it useful - which is tricky, when it's asked on a wrong site for it and hard to find because of it). ;) –  Noordung Apr 30 '13 at 8:48
    
You might find this thread on Server Fault interesting: Apache logging strategy on busy webserver: write contention?. –  Noordung Apr 30 '13 at 8:53

1 Answer 1

up vote 1 down vote accepted

In my experience, Apache logging (sub)system doesn't come with big enough CPU performance penalty even on extremely busy servers to be worth looking for optimisations down that path, so your optimisation efforts could probably be more rewarding, if you consider other possible bottlenecks, such as I/O and network lag.

  • First, make sure that the HostNameLookups is Off in your httpd.conf (or httpd-vhosts.conf) file. This setting, when On, adds a significant enough lag when resolving DNS names that it may pay off to switch it off on busy servers. If you need to resolve DNS names for statistical and tracking purposes, then I recommend using hardware based DNS resolvers (router, switch, firewall) that have DNS caching capability and can mostly do this asynchronously, then link to these logs when analyzing traffic data.

  • Second, analyze your server's I/O performance and check that frequent writes (IIRC Apache doesn't really read anything from these log files, it just appends to them as a file stream) don't take a significant percentage of your total I/O operations that your server can handle. On spindles (HDD), this can be costly, so you could consider spreading these logs to multiple physical drives instead of writing them all to a single drive. Obviously, if you're using HDDs, switching to SSDs is highly recommended, as they are capable of much higher IOPS. Also check suggestions for this question on Server Fault.

  • You could also check that you're only logging requests that you really need to. Often, requests to some file types aren't even needed or can be moved to other, simpler logs that don't consume system's resources so much (i.e. don't require DNS resolver, if you need this data logged for other requests). Both of this can be set in your Apache configuration file and might save you a microsecond or two on each request (which can accumulate).

Other suggestions could be load-balancing, moving some of the most frequently accessed files to another location and creating your own CDN, and so on, but these already fall way out of the scope of your question about Apache logfile performance.

share|improve this answer
1  
Ok, so from what I heard now, it won't make much difference on my server, cause the load is not critical. But I got good hints from this question for more optimization, so I mark this solved. Thanks –  rubo77 Apr 30 '13 at 11:41
    
CPU penalty? Disk latency will be an issue long before CPU usage becomes a problem. And fixing HostNameLookups has nothing to do with any bottlenecks arising from large numbers of log files. Using SSDs for logging is a very silly idea. No, writing 250 log files is unlikely to be a problem - but NOT FOR THE REASONS STATED HERE –  symcbean Apr 30 '13 at 13:11
    
@symcbean - What are you talking about? Have you read more than two words of what I wrote? You're using Internet the wrong way, it uses whole sentences!!! –  Noordung Apr 30 '13 at 14:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.