Apache日志轮询Cronolog安装及简单用法

安装日志轮询工具cronolog：

[root@bqh- tools]# tar xf cronolog-1.6..tar.gz
[root@bqh- tools]# cd cronolog-1.6.
[root@bqh- cronolog-1.6.]# ./configure
make
make install
[root@bqh- cronolog-1.6.]# ll /usr/local/sbin/cronolog
-rwxr-xr-x  root root  7月   : /usr/local/sbin/cronolog

按天轮询：（生产环境常见用法，推荐使用）：

CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_blog_%Y%m%d.log" combined
CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_bbs_%Y%m%d.log" combined

注：按天记录日志，日志不会自动覆盖。

按小时轮询：（较常见用法）

CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_blog_%Y%m%d%H.log" combined
CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_bbs_%Y%m%d%H.log" combined

注：适合短时间分析的apache详细日志信息。

按周轮询：（较常见用法）

CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_blog_%w.log" combined
CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_bbs_%w.log" combined
----------------------------------------------------------------------------------------------↓↓↓分目录按周记录日志
CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/%w/access_blog_%w.log" combined
CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/%w/access_bbs_%w.log" combined

注：每周循环覆盖；如果需要保留少量日志，供sa等使用，不作为特殊其他信息分析等，可以按周轮询，免去担心空间问题。

按月轮询：

CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_blog_%Y%m.log" combined
CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_bbs_%Y%m.log" combined

按天+按小时轮询：

CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_blog_%Y%m%d.log" combined
CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_blog_%Y%m%d%H.log" combined
CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_bbs_%Y%m%d.log" combined
CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_bbs_%Y%m%%d%H.log" combined

.....可以自由组合来轮询日志。

下面以按天轮询日志的测试配置：

[root@bqh- extra]# vim httpd-vhosts.conf

......以上省略
<VirtualHost *:>
    ServerAdmin @qq.com
    DocumentRoot "/var/html/blog"
    ServerName blog.bqh123.com
    ServerAlias bg.bqh123.com
    ErrorLog "logs/blog-error_log"
    CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_blog_%Y%m%d.log" combined
</VirtualHost>

<VirtualHost *:>
    ServerAdmin @qq.com
    DocumentRoot "/var/html/bbs"
    ServerName bbs.bqh123.com
    ServerAlias bs.bqh123.com
    ErrorLog "logs/bbs-error_log"
    CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_bbs_%Y%m%d.log" combined
</VirtualHost>

 刷新配置：

[root@bqh- extra]# vim httpd-vhosts.conf
[root@bqh- extra]# ../../bin/apachectl -t
Syntax OK
[root@bqh- extra]# ../../bin/apachectl graceful

访问测试，并查看日志：

[root@bqh- logs]# ll
总用量
-rw-r--r--  root   root   7月   : access_bbs_20190715.log
-rw-r--r--  root   root   7月   : access_blog_20190715.log
-rw-r--r--  root   root  7月   : access_log
-rw-r--r--  root   root   7月   : bbs-access_log
-rw-r--r--  root   root   7月   : bbs-error_log
-rw-r--r--  root   root  7月   : blog-access_log
-rw-r--r--  root   root   7月   : blog-error_log
srwx------  daemon root     7月   : cgisock.
srwx------  daemon root     7月   : cgisock.
srwx------  daemon root     7月   : cgisock.
-rw-r--r--  root   root  7月   : error_log
-rw-r--r--  root   root     7月   : httpd.pid
[root@bqh- logs]# tail - ./access_blog_20190715.log
192.168.0.105 - - [/Jul/::: +] "GET / HTTP/1.1"   "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0"
[root@bqh- logs]# tail - ./access_bbs_20190715.log
192.168.0.105 - - [/Jul/::: +] "GET / HTTP/1.1"   "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0"

apache不记录图片的日志：

程序配置：
<FilesMatch “\.(css|js|gif|jpg|ico|swf)”>
    SetEnv IMAG
</FilesMatch>

日志配置：
<VirtualHost *:>
    ServerAdmin @qq.com
    DocumentRoot "/var/html/bbs"
    ServerName bbs.bqh123.com
    ServerAlias bs.bqh123.com
    ErrorLog "logs/bbs-error_log"
    CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_bbs_%Y%m%d.log" combined env=!dontlog

RS服务器不记录负载均衡健康检查日志(check.html)：

<VirtualHost *:>
    ServerAdmin @qq.com
    DocumentRoot "/var/html/bbs"
    ServerName bbs.bqh123.com
    ServerAlias bs.bqh123.com
    SetEnvIf Request_URI “^/check\.html$” dontlog
    ErrorLog "logs/bbs-error_log"
    CustomLog "|/usr/local/sbin/cronolog /application/apache/logs/access_bbs_%Y%m%d.log" combined env=!dontlog
</VirtualHost>

统计apache日志单IP访问请求数排名：

[root@bqh- logs]# awk '{print $1}' ./access_bbs_20190715.log |sort|uniq -c|sort -rn -k1
      11 192.168.0.105
       9 192.168.0.200
       4 192.168.0.88
       3 192.168.0.109
       2 192.168.0.107
       1 192.168.0.10
         192.168.0.96
         192.168.0.5
         192.168.0.222
         192.168.0.15
         192.168.0.110
[root@bqh- logs]# awk '{++s[$1]} END {for (key in s) print s[key],key}' access_bbs_20190715.log |sort -rn -k1
 192.168.0.105
 192.168.0.200
 192.168.0.88
 192.168.0.109
 192.168.0.107
 192.168.0.10
 192.168.0.96
 192.168.0.5
 192.168.0.222
 192.168.0.15
 192.168.0.110