When generating apache logs for virtual hosts, is it preferable to log everything to a single file and then parse it at fixed intervals (via cron with split-logfile or similar), or is one access_log per virtual host acceptable?
The apache docs talk about file descriptor limits, but according to my /proc/sys/fs/file-max, I have a maximum of 8192 available. This seems like enough to handle the 100 or so vhosts I plan on having on this box since each access_log only consumes one descriptor. Perhaps I need to be concerned about a per-process limit?
Currently, I'm logging everything to a single access_log, and rotating daily via cronolog. Shortly after the rotation a cron job takes care of parsing the log file and running the stats generation scripts for each vhost.
If it's not unreasonable, I'd like to be able to log each vhost separately so that I could provide real-time stats if necessary. You know.... value-added and all.
The box is a P3, 1Ghz, 512MB RAM with Redhat 7.2 running apache 1.3.26. Any insight would be appreciated.