[Mithras]

Hi all,

I'm using a Combined format log for Apache. Everytime I get a hit, it appears twice! Is this on purpose? Or is this a dumb error?

Example:

218.168.206.23 - - [07/May/2003:04:55:09 -0400] "GET /Mansa/Public/AboutMyMac/screenshot.php HTTP/1.0" 200 714577 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/73 (KHTML, like Gecko) Safari/73"
218.168.206.23 - - [07/May/2003:04:55:09 -0400] "GET /Mansa/Public/AboutMyMac/screenshot.php HTTP/1.0" 200 714577 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/73 (KHTML, like Gecko) Safari/73"

Every line in the log is doubled like this. What could cause this?

Relevant lines from httpd.conf:

Code:
# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here.  If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog "/private/var/log/httpd/error_log"

#
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#
LogLevel warn

#
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
#
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

#
# The location and format of the access logfile (Common Logfile Format).
# If you do not define any access logfiles within a <VirtualHost>
# container, they will be logged here.  Contrariwise, if you *do*
# define per-<VirtualHost> access logfiles, transactions will be
# logged therein and *not* in this file.
#
CustomLog "/private/var/log/httpd/access_log" combined 
TransferLog "|rotatelogs /var/log/httpd/access_log 86400"
#

Anyone?

[utidjian]

Interesting...

Did you try to see if a simple plain vanilla .html file... when accessed... produces the same double log? For some reason I suspect it is the html code that you use for your site. Why? Because I have the exact same section in my httpd.conf file and I don't get double logs.

Are you running any virtual hosts?

[Mithras]

Everything is doubled -- everything.

127.0.0.1 - - [07/May/2003:09:47:44 -0400] "GET /test.html HTTP/1.1" 200 68 "-" "Links (0.98; Unix; 117x47)"
127.0.0.1 - - [07/May/2003:09:47:44 -0400] "GET /test.html HTTP/1.1" 200 68 "-" "Links (0.98; Unix; 117x47)"
127.0.0.1 - - [07/May/2003:09:49:11 -0400] "GET /PoweredByMacOSX.gif HTTP/1.1" 200 3726 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/73 (KHTML, like Gecko) Safari/73"
127.0.0.1 - - [07/May/2003:09:49:11 -0400] "GET /PoweredByMacOSX.gif HTTP/1.1" 200 3726 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/73 (KHTML, like Gecko) Safari/73"

It's really strange!

[utidjian]

Originally posted by Mithras:
Everything is doubled -- everything.
It's really strange!

OK.... hmmm... do a search through the httpd.conf file and look for more than one CustomLog directives in your config file. Is there more than one?

[Mithras]

Sorry I'm such a dolt. I should go through this very systematically. But until I do so:

[mithras@localhost: mithras] grep Log /etc/httpd/httpd.conf
# HostnameLookups: Log the names of clients or just their IP addresses
# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
ErrorLog "/private/var/log/httpd/error_log"
# LogLevel: Control the number of messages logged to the error_log.
LogLevel warn
# a CustomLog directive (see below).
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
# The location and format of the access logfile (Common Logfile Format).
CustomLog "/private/var/log/httpd/access_log" combined
#CustomLog "/private/var/log/httpd/referer_log" referer
#CustomLog "/private/var/log/httpd/agent_log" agent
# (Combined Logfile Format) you can use the following directive.
#CustomLog "/private/var/log/httpd/access_log" combined
# ErrorLog logs/dummy-host.example.com-error_log
# CustomLog logs/dummy-host.example.com-access_log common

So that's a negative. Hmmm.
I'll try going to the stock httpd.conf and compare line-by-line.

[utidjian]

Originally posted by Mithras:
Sorry I'm such a dolt. I should go through this very systematically. But until I do so:
So that's a negative. Hmmm.
I'll try going to the stock httpd.conf and compare line-by-line.

You did a grep for "Log"... also do a grep for "log".

You can also do a diff on the two files:

diff httpd.conf old.httpd.conf

-DU-...etc...

[gatorparrots]

grep -i is case insensitive.
*wink*

[rkt]

Originally posted by Mithras:
I'm using a Combined format log for Apache. Everytime I get a hit, it appears twice! Is this on purpose? Or is this a dumb error?

Every line in the log is doubled like this. What could cause this?

you don't need to use both CustomLog *and* TransferLog.

comment out the TransferLog line, and the duplicates should no longer be recorded...

(fyi, you can create as many log files as you want with apache... just keep adding more Transfer/CustomLog directives. you got doubled output because you pointed both directives at the /same/ file)

[Mithras]

Thanks everyone, I figured it out.

Turns out I had an extraneous httpd.conf that had crept into /etc/httpd/users/. That conf file's duplicate Log directives were causing the problem.

rkt, the TransferLog directive just does the rotation so logs don't get too big -- it certainly doesn't cause log doubling, because only the CustomLog directive actually tells apache which type of log to write.

It's disturbingly powerful yet hidden, that /users/ directory. Especially when I had turned off echoing which /users/ directives were being processed at startup...

[rkt]

Originally posted by Mithras:
rkt, the TransferLog directive just does the rotation so logs don't get too big -- it certainly doesn't cause log doubling, because only the CustomLog directive actually tells apache which type of log to write.

hmm, okay. that begs the question why use a TransferLog directive at all?

ie, just this instead:
CustomLog "| rotatelogs /var/log/httpd/access_log 86400" combined

from apache 1.3 docs:
"This directive has exactly the same arguments and effect as the CustomLog directive, with the exception that it does not allow the log format to be specified explicitly or for conditional logging of requests."