Topic: access_log (apache) stays suddenly empty (solved)

[Henk]

Since december 5 my server stopped updating the httpd access log. All logs are updated, except access_log.

I didn't change a thing but suddenly noticed that awstats wasn't updated anymore. The script and the cron jobs are working fine, so I started to search for the problem. The only cause I can find is the access_log in /var/log/httpd.

I've already restarted the server, deleted all the old access_log files, but nothing seems to solve the problem. After deleting the old access_log, a new one is written, but the size stays 0.

Anyone an idea how to solve this?

[Black]

That's strange. What happens if you tail -f the logs and try different access methods?

[Henk]

That's strange. What happens if you tail -f the logs and try different access methods?

I don't know what should happen, but when I type tail -f access_log nothing happens. I'm not sure how to use your directions.

Today a new access_log appeared, and that one also has size 0.

Maybe this gives some information. When using top, very often a couple of httpd <defunct> lines appear on my screen. This is an example:

19569 www       14   0     0    0     0 Z     0.5  0.0   0:00 httpd <defunct>

I don't know what this means, but my guess is that a httpd process goes wrong.

[Henk]

Maybe this helps someone to discover what's going wrong on my server. It's a part of my httpd error_log. There are hundreds of file size notices in that logfile.

Wed Dec 08 01:12:41 2004] [warn-phpa] Stale process 17414 detected (pid 17437)
[Wed Dec 08 01:12:41 2004] [notice-phpa] PHPA 1.3.3r2 on linux_i686_glibc2.1.3 (pid 17437)
[Wed Dec 08 01:12:41 2004] [notice-phpa] Initialised 8MB cache at 0x44e5d000 with 512 process entries (pid 17437)
[Wed Dec 08 01:12:41 2004] [notice-phpa] Lock thresholds 10/10 (pid 17437)
[Wed Dec  8 01:12:42 2004] [notice] child pid 17439 exit signal File size limit exceeded (25)
[Wed Dec  8 01:12:42 2004] [notice] child pid 17438 exit signal File size limit exceeded (25)
[Wed Dec  8 01:12:42 2004] [notice] child pid 17437 exit signal File size limit exceeded (25)
[Wed Dec  8 01:12:42 2004] [notice] child pid 17436

[Henk]

Problem Solved  

Using find / -size +1000000000c I found out that my mod_gzip.log was > 2Gb. I read somewhere that log files >2Gb were causing this sort of problems. Deleting the big mod_gzip.log file solved the problem

[Black]

I was reffering to tail -f /var/log messages  and you can see the output real time. Then try accessing your site and try posrt scanning and stuff to generate traffic and see if it creates a log file..

Looks like you got it..Can you explain to me what you did? Will that command find anything on the system larger then a gig?


Thanks

[Henk]

I simply googles for [notice] child pid exit signal File size limit exceeded (25) and found a lot of links. One discibed me that files >2Gb causes problems on systems. An other link gave me this:

to find all files on your system larger than
1 billion bytes (roughly 1 GB), you can use:

find / -size +1000000000c

de '/' indicates the starting directory (root here)
+1000000000c indicates larger than (+) 1000000000
bytes (believe it or not, the c stands for bytes.
If you put a b instead of a c, it thinks you are
looking for 1000000000 blocks. with 1 block being
512 bytes.

If you have a lot of files on your system, this
command may take some time. To speed it up you can
change the starting directory.

Note: the find command is recursive and iterates
thru all directories.

source: http://www.faqts.com/knowledge_base/view.phtml/aid/10067/fid/56

This command pointed me to a gzip.log with a size >2Gb. I deleted that file and everything runs fine again.

tail -f /var/log/httpd/access_log indeed gives me real-time output of the log file.