CODEWITHSUNDEEP
regexapachemod-rewritelogging
Anders
Anders

Reputation: 279

Custom Apache log file based on regular expression

I'm working on a project, which require a special Centos Apache server setup. All entries must be pre-processed and sorted by certain conditions and then placed into separate log files.

Take these Apache requests, for instance:

http://logs.domain.com/log.gif?obj=test01|id=886655774|e=via|r=4524925241
http://logs.domain.com/log.gif?obj=test01|id=886655774|e=via|r=9746354562

For every entry, Apache must search through the request URL. If it finds the "obj"-parameter, a log with this name must be created. In this case, one file with the name "test01" is created (if it doesn't already exist), containing these two entries.

I found this among others: http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html and assume, it could be done with some kind of RegEx, but I still need a further push in the right direction, please.

Upvotes: 0

Views: 254

Answers (1)

Pi Marillion
Pi Marillion

Reputation: 4674

Apache does not support this sort of fine-grain log directing. However, you could certainly write a log reader which reads from the Apache logs and subsequently writes the appropriate sub-logs.

There are three things to be aware of:

  1. Apache log writes are not atomic and Apache uses no file locking. That means that the program reading the log cannot be guarunteed that the last log entry is complete, and that there is no reliable real-time way to tell if Apache is currently writing to the log.

  2. The error logs can have multiple lines, and only the first would match your pattern. Additionally, many CGI scripts will write lines without the appropriate prefix. This is very difficult to control unless you write all the code yourself. The access log, at least, is pretty standard 1 line = 1 entry with prefix though.

  3. The reader must keep track of the current file atime, ctime, and size somewhere on disk, so that if it's stopped and restarted, it can continue where it left off. Additionally, it must correctly handle the switch-over when Apache begins writing a new log. (The old log is renamed.)

Upvotes: 1

Related Questions