====== Apache - Logs - Use vlogger to split Apache logs ======

**Vlogger** is a program that handles large amounts of virtualhost logs and splits it to separate files.

This is a short HOWTO to configure it using Apache.

----

===== Install vlogger =====

<code bash>
sudo apt install vlogger
</code>

----

Make sure you have working Apache server

===== Configuring vlogger =====

Change the LogFormat line (there are multiple LogFormat lines – in this example we will change the one that is named combined) in /etc/apache2/apache2.conf.

<code bash>
sudo vi /etc/apache2/apache2.conf
</code>

Add the string %v at the beginning of it.

<file bash /etc/apache2/apache2.conf>
#LogFormat “%h %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”" combined
LogFormat “%v %h %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”" combined
</file>


Add the following CustomLog line to the same file (you can put it directly after the LogFormat line)

<code bash>
sudo vi /etc/apache2/apache2.conf
</code>

<file bash /etc/apache2/apache2.conf>
CustomLog “| /usr/sbin/vlogger -s access.log /var/log/apache2″ combined
</file>

<WRAP info>
**NOTE:**  Only one CustomLog directive is neededd in the entire Apache configuration.

  * Please disable all other CustomLog directives, especially in any virtual host configurations.

</WRAP>

----

===== Restart Apache =====

<code bash>
sudo /etc/init.d/apache2 restart
</code>

<WRAP info>
**NOTE:**  Vlogger will now create subdirectories in the /var/log/apache2 directory, one per virtual host, and create access logs that contain the current date in the file name.

  * It will also create a symlink called access.log that points to the current log file.

</WRAP>

----

===== Result =====

Assuming there are two virtual hosts, www.example1.com and www.example2.com. 

Then this is how the /var/log/apache2 directory will look like:

<code bash>
ls /var/log/apache2/
</code>

returns:

<code bash>
www.example1.com/
09022008-access.log
09012008-access.log
access.log -> 09022008-access.log
www.example2.com/
09022008-access.log
09012008-access.log
access.log -> 09022008-access.log
</code>