Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

At my webserver, I have separate logfiles for all my over 250 domains.

Is this showing the server down? Would it be faster to have only one logfile that contains all access-logs?

Update:
I will try Disable Apache logging completely

share|improve this question

migrated from security.stackexchange.com Apr 30 '13 at 12:18

This question came from our site for information security professionals.

3  
How is this related to IT Security? Maybe Server Fault, or Webmasters would be better suited for this question? Also, it would probably be easier to simply try it than to speculate on it. If you can't move your current logs, then you could create additional ones first as a direct copy of existing ones, then as a single file of all your domains, and run some benchmarks in between two tests then compare. Whichever turns out to be faster, holds the key to your answer then. –  TildalWave Apr 30 '13 at 8:27
    
I thought, this is a place to ask questions, if someone has done this already. If not, sure, then I will start some benchmarks myself, but why reinvent the wheel? Why the downvote? If this fits better to Server Fault, couldn't you just move this question there instead of downvoting? –  rubo77 Apr 30 '13 at 8:42
    
As per FAQ, your question is off topic. If your question doesn't have a duplicate on the websites I mentioned in my previous comment, then it will be moved there (whichever of the two it fits better) by moderators. Voting usually reverses once the question finds its proper place (answerers tend to upvote questions they give answers to, others can upvote it too if they find it useful - which is tricky, when it's asked on a wrong site for it and hard to find because of it). ;) –  TildalWave Apr 30 '13 at 8:48
    
You might find this thread on Server Fault interesting: Apache logging strategy on busy webserver: write contention?. –  TildalWave Apr 30 '13 at 8:53

2 Answers 2

In my experience, Apache logging (sub)system doesn't come with big enough CPU performance penalty even on extremely busy servers to be worth looking for optimisations down that path, so your optimisation efforts could probably be more rewarding, if you consider other possible bottlenecks, such as I/O and network lag.

  • First, make sure that the HostNameLookups is Off in your httpd.conf (or httpd-vhosts.conf) file. This setting, when On, adds a significant enough lag when resolving DNS names that it may pay off to switch it off on busy servers. If you need to resolve DNS names for statistical and tracking purposes, then I recommend using hardware based DNS resolvers (router, switch, firewall) that have DNS caching capability and can mostly do this asynchronously, then link to these logs when analyzing traffic data.

  • Second, analyze your server's I/O performance and check that frequent writes (IIRC Apache doesn't really read anything from these log files, it just appends to them as a file stream) don't take a significant percentage of your total I/O operations that your server can handle. On spindles (HDD), this can be costly, so you could consider spreading these logs to multiple physical drives instead of writing them all to a single drive. Obviously, if you're using HDDs, switching to SSDs is highly recommended, as they are capable of much higher IOPS. Also check suggestions for this question on Server Fault.

  • You could also check that you're only logging requests that you really need to. Often, requests to some file types aren't even needed or can be moved to other, simpler logs that don't consume system's resources so much (i.e. don't require DNS resolver, if you need this data logged for other requests). Both of this can be set in your Apache configuration file and might save you a microsecond or two on each request (which can accumulate).

Other suggestions could be load-balancing, moving some of the most frequently accessed files to another location and creating your own CDN, and so on, but these already fall way out of the scope of your question about Apache logfile performance.

share|improve this answer
1  
Ok, so from what I heard now, it won't make much difference on my server, cause the load is not critical. But I got good hints from this question for more optimization, so I mark this solved. Thanks –  rubo77 Apr 30 '13 at 11:41
    
HostnameLookups already was "Off" but see my comments in the other answer, It saved a lot of diskusage disabling all logging –  rubo77 May 19 at 15:20
    
HostnameLookups already was "Off" and see my comments in the other answer, It doesn't seem to save diskusage disabling all logging –  rubo77 May 19 at 15:49

I suggest you check /server-status and sar -d -p. If you see L - Logging state and have high disk latency (see sar's column await higher than tens of msecs), then you would most likely get better performance writing to only one place on the disk rather than to hundreds opened files.

share|improve this answer
    
I had to enable sysstat in /etc/default/sysstat and restart with /etc/init.d/sysstat restart to watch "system activity information" as the man sais, but there seems to be nothing collected now. how long do I have to wait untill it collects anything? and wouldn't sysstat now cost performance too? –  rubo77 May 19 at 13:15
    
I see, it collects data every 10 min by cron. I have a high await value on sda all the time (min. 28 max 149 over the last hour) –  rubo77 May 19 at 14:18
    
I can watch -d -c 'sar -d -p|while read i; do echo $i; done|cut -d" " -f1,2,8|grep -v 0,00' and I see: the await time doesn't seem to be affected by logging. Does this mean disabling logging doesn't affect the performance? –  rubo77 May 19 at 15:48
    
I collect sar data every second when tuning: 5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 600 However, you can just collect data ad hoc, this will do samples every second and count average for 5 seconds: sar -d -p 1 5 Run this in your peak time and check the average. Writing into one log file or turning off logs would help in situation when logs are on the same device as your static files and when multiple robots visit your server and download many different static pages - when the files simply do not fit to the cache. –  brablc May 19 at 20:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.