Mixing Apache2 and nginx log file
My configuration is a bit specific. I have an Apache server for PHP and Python stuff with nginx as a frontend (and for serving static files like this blog). This part seems normal for most of people. BUT, in my case, I want that the two servers write the access logs IN THE SAME FILE (/var/log/apache2/access.log)
I run a Debian stable on my server. With the previous version (7.0), all was fine, but, until Jessie (8.0), I found a very strange behaviour with my web statistics analyzer. I usually have from 60 to 80 visits per day. In may (after the upgrade to Jessie), I get only 2 or 3 visits per day, using only one subdomain. Plus, it's a period where I have no internet at home and no time to investigate...
Finally, I found the problem ! It's located in logrotate. The two files are :
/etc/logrotate.d/apache2
/var/log/apache2/*.log {
daily
missingok
rotate 14
...
postrotate
if /etc/init.d/apache2 status > /dev/null ; then \
/etc/init.d/apache2 reload > /dev/null; \
fi;
endscript
...
}
And /etc/logrotate.d/nginx
/var/log/nginx/*.log {
weekly
missingok
rotate 52
...
postrotate
invoke-rc.d nginx rotate >/dev/null 2>&1
endscript
}
The first one do a logrotate every day of all files in /var/log/apache2/*.log (that contains our . The second one, do only one logrotate every week. But, the most important line is located in postrotate. Why it's important ? Because it says to nginx and Apache "Now the log file has changed, close the previous and open the new one". Seems correct, but without that, nginx write in /var/log/apache2/access.log.1 and not /var/log/apache2/access.log until it gets rotated (after a week) because it will keep the handle on access.log that is renamed to access.log.1 by logrotate.
The solution is to add
invoke-rc.d nginx rotate >/dev/null 2>&1
In the postrotate section of /etc/logrotate.d/apache2 (after the if). Then, restart nginx :
systemctl restart nginx