Reducing logging in Apache

[Tim Wunder]

On Monday 06 December 2004 6:53 pm, someone claiming to be Kurt Wall wrote:
> On Mon, Dec 06, 2004 at 04:10:17PM -0700, Brian Simper took 21 lines to 
write:
> > I have a small Apache web server on Red Hat Enterprise Linux 3.0.  I
> > am still rather new to Apache but it does function quite well.
> > However, the logs are filling up quickly and I would like to slow this
> > down.  Is there a simple way to *not* log graphics?  This is a simple
> > department web server within a corporate firewall and we don't need to
> > track access to pictures.  Also are there any general guidelines for
> > reduce overall log chattiness?  I would be happy with reducing the log
> > to show a simple tally of pages accessed.
>
> You have a couple of options. First of all, Apache regards a "page"
> as any request. If you are only interested in logging HTML pages loaded,
> something like the following untested configuration might do:
>
> SetEnvIf Request_URI \.html$ html-pages
> CustomLog html-pages.log common env=html-pages
> CustomLog "|>/dev/null" env=!html-pages
>
> This logs all files retrieved whose names end with ".html" to
> $LOGDIR/html-pages.log. Everything else goes to /dev/null. Works over here,
> but YMMV and if it breaks you get to keep both pieces.
>
> Personally, I think you're going about this the wrong way. Log everything,
> just rotate the logs each day/week/month or whatever the corporate policy
> dictates. I hate to lose data.
>
> Kurt

I know there used to was an IIS WebDav exploit that caused my error log to get 
quite large quite fast. Here's the section of my httpd.conf file that 
addressees it:
ErrorLog logs/error_log
LogLevel warn
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" 
combined
# Added !414 to eliminate long SEARCH requests logs (IIS WebDav exploit) - 
7/16/04
LogFormat "%h %l %u %t \"%!414r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
CustomLog logs/access_log combined

Since Brian didn't say which logs are filling up fast, I figgerd I'd throw 
this out there and see if it stuck...

Tim

-- 
Fedora Core 2, Kernel 2.6.9-1.6_FC2,  KDE 3.3.1, Xorg 6.7.0
 21:20:00 up 2 days, 10:12,  2 users,  load average: 0.04, 0.28, 0.18
It's what you learn after you know it all that counts