Webalizer and apache log

My apache log is very big, and I want to do log rotate. But, I think this will affect the webalizer result, it will not be accurate.

Anyone know what is the best way to solve this? Basically I dont want the apache log to be a very big files but I also want the webalizer to be able to create accurate output.

Please help,

Thanks.
nova2002Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

heskyttbergCommented:
Hi!

Well how often do you run webalizer ?
When does webalizer run ?

I ran webalizer every hour.
I rotated logs once every week, keeping 4 weeks.

This gave us very good accuracy, I never experienced that we lost any info.
Let's say webalizer runs 0:00 at night, every hour.
The logrotate runs at the same time, but it's not only apache logs that needs rotating.
Webalizer only has to parse one hour of traffic.
It will most likely be done by the time logrotate comes to apache.

If you are really, really unlucky, you might loose 45-60 minutes of traffic between 23:0x and 24:0x.

But my experience is that I at most lost 1-3 minutes if any at all.
Thoose minutes are between 24:00-24:03

Regards
/Hasse
0
nova2002Author Commented:
I came up with this solution:

* I edited "httpd" logrotate configuration in /etc/logrotate.d to be like this :

/home/www/mydomain.com/logs/*log {
    missingok
    notifempty
    sharedscripts
    prerotate
        /usr/bin/webalizer
    endscript
    postrotate
        /bin/kill -HUP `cat /var/run/httpd.pid 2>/dev/null` 2> /dev/null || true
    endscript
}

* I set webalizer.conf to do incremental and the log file to be processed is :

   /home/www/mydomain.com/logs/apache.log

* I removed 00Webalizer from /etc/cron.daily , because webalizer will be executed by logrotate process.

My scenario is : When the logrotate process occured, it will run webalizer and then rotate the log.

Is this a good solution? Or is it wrong?

I am not an experience linux admin btw.

Please if you can verify my solution :)

Thank you
0
heskyttbergCommented:

That is a very good solution, you may still loose a few minutes.

But that shouldn't matter much.

I just did a webalizer each hour and logrotate each week, I didn't seem to loose any traffic at all.

Regards
/Hasse
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Apache Web Server

From novice to tech pro — start learning today.