apache2 logging goes wrong

[mr.x]

Hi all,

I am facing a strange problem ...
.. something went wrong with the logfiles from apache2.
I migrated from vhcs2.4.7.1 to ispcp two weeks ago with smaller isues but most of them are solved. Thanks to the great forum here !!!

But now due to the logfile issue I think my traffic calculation went wrong.
I get very huge other_vhosts_access.log files. Round about 100MB per day. But inside the file are informations from other valid domains which I am hosting.

Code:

cat other_vhosts_access.log
xxx.de:80 93.211.64.211 - - [06/Sep/2009:12:16:30 +0200] "GET /images/ebay/tables/adapters/A_5.jpg HTTP/1.1" 200 17265 "http://cgi.ebay.de/WLAN-Yagi-Antenne-18dBi-3M-Netgear-Edimax-D-Link-Wifi_W0QQitemZ230370040324QQcmdZViewItemQQptZDE_Computer_Peripherie_Netzwerk?has​h=item35a31fda04&_trksid=p3286.c0.m14" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729)"
xxx.de:80 93.211.64.211 - - [06/Sep/2009:12:16:30 +0200] "GET /images/ebay/tables/adapters/A_6.jpg HTTP/1.1" 200 19529 "http://cgi.ebay.de/WLAN-Yagi-Antenne-18dBi-3^C
[...]
yyy.com:80 91.34.146.165 - - [06/Sep/2009:12:17:26 +0200] "GET /zzz/en/img/schulfotos/103/st__hildae32123_s_college-652.jpg HTTP/1.1" 200 37901 "http://www.zzz.com/zzz/sprachschulen/england/oxford/st__hildaffdss3_s_college.php?bereich=1&sprache=1&land=3&unterbringung=2&preiskat=2&alter=16" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729)"
yyy.com:80 84.143.220.238 - - [06/Sep/2009:12:17:29 +0200] "POST /zzz/sprachschulen/england/oxford/st__hilda_s_college.php HTTP/1.0" 200 31006 "http://www.yyy.com/zzz/sprachschulen/england/oxford/st__hilda_s_43college.php" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729)"
yyy.com:80 91.34.146.165 - - [06/Sep/2009:12:17:29 +0200] "GET /zzz/img/schulfotos/103/st__hilda2344_s_college-651.jpg HTTP/1.1" 200 53129 "http://www.yyy.com/zzz/sprachschulen/engla^C

In my apache.conf is this parameter

Code:

#
# Define an access log for VirtualHosts that don't define their own logfile
CustomLog /var/log/apache2/other_vhosts_access.log vhost_combined

Does anybody knows why this went wrong?

Br
Jan

[sci2tech]

Nothing is wrong. New system logger is not defined per vhost. So if you do not comment line

Code:

CustomLog /var/log/apache2/other_vhosts_access.log vhost_combined

all logs from all defined vhost will also be added here.

[mr.x]

Hi sci2tech,

(09-08-2009 01:35 AM)sci2tech Wrote:  Nothing is wrong. New system logger is not defined per vhost. So if you do not comment line

Code:

CustomLog /var/log/apache2/other_vhosts_access.log vhost_combined

all logs from all defined vhost will also be added here.

dam man, you are right !
But how can this happens?
When I take a look at the stats of a specific domain, then I can see that there is a big different as i switched to ispcp.

Code:

1.95 GB
1.80 GB
1.83 GB
1.85 GB
1.99 GB
2.12 GB
2.14 GB
260.48 MB
34.43 MB
60.59 MB
43.93 MB

Everyday rounf about 2 GB and now only 50 MB?? There is something wrong with the traffic counting. Its not the domain, visits still as before or even more due to advertisement for this shop .-/

Where should I start searching "to shot the trouble" ? .-)

Br
Jan

[sci2tech]

Counting the traffic is an issue. Is counting only traffic from domain and aliases not from subdomain. This must be corected by us (dev team) but can predict when.

[mr.x]

(09-09-2009 02:23 AM)sci2tech Wrote:  Counting the traffic is an issue. Is counting only traffic from domain and aliases not from subdomain. This must be corected by us (dev team) but can predict when.

Can I help here?
What must be done?

Br
Jan

[sci2tech]

ispcp-vrl-traff must be rewritten

[mr.x]

Hi,

(09-09-2009 02:46 AM)sci2tech Wrote:  ispcp-vrl-traff must be rewritten

ok, its in perl. I am not an perl expert but I can read and understand it.
I'll give it a try.

But I need may be more infos:
- Which one should be my baseline? trunk or tag?
- Are there additional infos available where the issue starts?
- Any ideas how to set it up?

With subdomain you mean http://www.xxx.tld

Br
Jan

[sci2tech]

(09-09-2009 03:35 AM)mr.x Wrote:  Hi,

ok, its in perl. I am not an perl expert but I can read and understand it.
I'll give it a try.

But I need may be more infos:
- Which one should be my baseline? trunk or tag?
- Are there additional infos available where the issue starts?
- Any ideas how to set it up?

With subdomain you mean http://www.xxx.tld

Br
Jan

Always use trunk. Some issue-> now subdomains go in separate log file so traff engine do not read them. You need to extract all subdomains from database then parse logs as the domains log are parsed. Also some ckecks on the mode iptables read traffic. Somethig is strange there too.
www traffic goes to main domain log so not this can be the problem. I was talking about added subdomains and alias subdomains.

[mr.x]

Hi,

(09-09-2009 04:08 AM)sci2tech Wrote:  Always use trunk. Some issue-> now subdomains go in separate log file so traff engine do not read them. You need to extract all subdomains from database then parse logs as the domains log are parsed. Also some ckecks on the mode iptables read traffic. Somethig is strange there too.
www traffic goes to main domain log so not this can be the problem. I was talking about added subdomains and alias subdomains.

I will take a look and see what I can do.