1

I have a couple of questions about Apache httpd logging on Scientfic Linux 7

Apache logging seems to be using some kind of hard-link from the configured logs directory /etc/httpd/logs to /var/log/httpd (although the directories are on separate filesystems?!?!)

If a file is created in /etc/httpd/logs it also appears in /var/log/httpd. The disk usage for "/" (where /etc/httpd/logs lives) does not increase but it does for "/var" (where /var/log/httpd)

I cannot see any references to any softlinks between files or directories in the 2 locations.

This output shows that both directories have the same inode reference:

lsof /var/log/httpd/
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
bash    5062 root  cwd    DIR    8,6       52 3271451 /etc/httpd/../..

lsof /var/log/httpd/
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
bash    5062 root  cwd    DIR    8,6       52 3271451 /var/log/httpd

This shows that the 2 directories should be on different filesystems.

df
Filesystem     1K-blocks    Used Available Use% Mounted on
/dev/sda2        5109760 1170352   3939408  23% /
devtmpfs          933028       0    933028   0% /dev
tmpfs             942256       0    942256   0% /dev/shm
tmpfs             942256   16928    925328   2% /run
tmpfs             942256       0    942256   0% /sys/fs/cgroup
/dev/sda8          98988    5328     93660   6% /home
/dev/sda5        1020588   32984    987604   4% /tmp
/dev/sda6        1020588  882452    138136  87% /var
/dev/sda7         201388   61384    140004  31% /support
/dev/sda9          47788   10080     37708  22% /var/log/audit
/dev/sda1         252588  153472     99116  61% /boot
tmpfs             188452       0    188452   0% /run/user/0

This shows the inode directory listing for the 2 directories:

ll -id /var/log/httpd /etc/httpd/logs/
3271451 drwx------ 2 root root 52 Jun 20 14:06 /etc/httpd/logs/
3271451 drwx------ 2 root root 52 Jun 20 14:06 /var/log/httpd

My 1st question is how is this configuration possible? I didnt think you could hard link across filesystems - is it possibly using some kind of bind mount?

My 2nd question is how can we stop Apache logging here? There is nothing at all in any of Apache's config files to reference logging under /var

Any advice would be much appreciated.

  • 1
    Your ll -id /var/log/httpd /etc/httpd/logs/ command has a / at the end so you're forcing a dereference of the symlink. Do it without the / and you'll see /etc/httpd/logs is a symlink to ../../var/log/httpd or similar. ll -id /var/log/httpd /etc/httpd/logs – Stephen Harris Jun 20 '16 at 13:55
2

You are correct, hard links cannot span file system boundaries, though in this example there is a soft-link under /etc/httpd for the logs directory:

logs -> ../../var/log/httpd

These types of symbolic links can be by pathname that can span these boundaries. What you have described looks like the typical Red Hat/Scientific setup for Apache.

In the file /etc/httpd/conf/httpd.conf you can verify the logging location, normally ErrorLog and CustomLog is setup, these can be changed. Though if you want to change all the logging to a single location you might want to change the symlink under /etc/httpd

| improve this answer | |
  • Thanks for both replies - a softlink makes total sense. I just wasnt seeing it due to the trailing "/" as mentioned (d'oh!) – Madmin Jun 21 '16 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.