For the last few days I've been having problems with the log processing on my RaQ 3. The log processing has at times brought the machine down. Right now analog is running and consuming tons of CPU. split_logs and webalizer also seem to significantly impact the machine when they're running.

My RaQ is maxed out with 512M of memory and I just changed the log_rotation to run 4 times a day rather than once. It will rotate and process the access log when it goes over 2M. The site gets anywhere from 50-90K page views 150-250K hits a day. It seems to me that people are getting more traffic without the log processing killing the machine.

Any thoughts? The site is almost entirely dynamic and typically runs at a load average around 1 with decent performance. With the log processing now it's around 5 - 7 load average and noticably slower performance.

Yeah I would like to know a method to turn this off.

The exact same thing crashed my Raq4 several times. I started rotating the logs 4 times a day, but it turns out you can very easily disable logging altogether, if you don't need the logs.

Telnet to the Raq and login as ROOT. Go to:

/etc/httpd/conf

and edit httpd.conf ... Now locate the line that says:

CustomLog /var/log/httpd/access combined

and comment it out:

#CustomLog /var/log/httpd/access combined

Now reboot the Raq with:

/sbin/shutdown -r now

No more access logs. Voila!

Originally posted by jnestor
Any thoughts? The site is almost entirely dynamic and typically runs at a load average around 1 with decent performance.

Do you run PHP pages?

Have you considered installing APC to get extra speed?

<<MOD EDIT:>>
You may not post URLs in your posts. Please set up a signature in your profile.
<</MOD EDIT>>

Yeah, I thought about that but I would actually like to keep the logs. I don't need the stupid cobalt traffic reports so I was considering removing the analog processing. I wonder if this is all related to the "upgrade" that causes the /usr/admserv/html/.cobalt/report files to grow seemingly without bounds.

2 Hours to process the logs. Webalizer ran in just a couple minutes. This is crazy.

Originally posted by jnestor
Yeah, I thought about that but I would actually like to keep the logs. I don't need the stupid cobalt traffic reports so I was considering removing the analog processing. I wonder if this is all related to the "upgrade" that causes the /usr/admserv/html/.cobalt/report files to grow seemingly without bounds.

2 Hours to process the logs. Webalizer ran in just a couple minutes. This is crazy.

Just change the split_logs program and disable analog -- then you can keep logs and logrotation.. and let Webalizer, Traffic Light, or similar take care of analyzing the logs.

--
Jens Kristian Søgaard, Mermaid Consulting I/S,
jens@mermaidconsulting.dk,
http://www.mermaidconsulting.com/
http://www.dns-software.com/

I have remove the log files all together and it seems faster now. Thanks. :)

Well after spending way more time poking around in the RaQ log and stats code than I'd like I still hadn't really come to any conclusions. I decided to go with my guts and remove the web.stats and web.cache files in the /usr/admserv/html/.cobalt/report directory. These files had been growing without bound lately and are the reason a lot of people are running out of room in their root partition.

As I suspected, the files were re-created on the next run of the logs. My stats from the cobalt CP seem to start from yesterday but since I never use those anyway I really don't care. Webalizer doesn't use those files and so is not affected. As best as I can tell the last run took about 1/2 an hour to process the logs.

I've since moved my log processing back to the original daily schedule and I'm planning to insert statements to delete those files somewhere in there though I'm not quite sure where yet.

This is almost certainly a bug introduced by cobalt in one of their patches. I suspect it's the one that updated analog.

This is one thing i don't like playing with the log files. Is it safe to remove these? and will the server re-create them? any problems with doing this?

Well, I can only tell you what worked for me. It's important to remember that I don't use the RaQ provided stats at all. I'm also the only one on the machine so no one else is using them either. I have Webalizer installed for the stats I use.

I also know for a fact that these files have been growing seemingly without bounds for a while now. It's pretty clear to me that it was a bug Cobalt introduced that prevents these files from being truncated appropriately.

Anyway what I did just to be safe was to rename the files and keep them around. I figured if something blew-up I could just move them back. In my experience the processing did re-create the files and everything worked fine. The RaQ stats lost the stats for everything but the current day so if you use the RaQ stats I wouldn't recommend this. It seems like it only affected the overall server stats and not the individual site stats which is what I'd suspect.

If you aren't having problems with the log processing I wouldn't touch this. If you are or if your disk is filling up with the ever growing logs it might be worth a shot. I can't make any promisses that it'll work for you though.

How do you change split_logs program and disable analog ?

In my experience, it's not just analog but also parseReport.pl that cause problems. split_logs is a perl program in /usr/local/sbin so you can just go in and edit to your hearts content. I'm not sure I'd recommend it though since I couldn't untangle exactly what I needed to leave and what I could comment out. I was planning on commenting out the two system calls to analog and probably the same for parseReport.pl but found just removing the log files to be easier.