In a DevOps development methodology the monitoring of resources in production is essential. It not only alerts the team to potential issues, but also ensures resources are being used effectively. Continuous analyses of your server can provide insightful information that can be used to improve your hosting configuration as well as your placement in search engines. More in-depth analytics can help you assess the design on your site, the flow-through of users, and the traction of marketing campaigns.
Internal monitoring reads the outputted logs of all the daemons to look for potential issues. Although monitoring for intruders is one way to use logs (as described in Chapter 16), other applications include watching for high disk usage, memory swap, or traffic bursts. By monitoring for unusual patterns, the system administrator can be notified by email and respond in a timely manner, perhaps before anyone even notices.
Webserver directives determine what information goes into the WWW logs. Everything in the logs can be analyzed later, but you want to balance that with what’s needed, since too much logging can slow down the server. While logging is important, it can be disabled to achieve higher efficiency.
Although Apache and NginX provide some good default logging options, they also allow you to override what’s logged by configuring custom log types. Apache’s LogFormat directive uses a format string using many of the entries below.
%a outputs the remote IP address.
%b is the size of the response in bytes.
%f is the filename.
%h is the remote host.
%m is the request method.
%q is the query string.
%T is the time it took to process the request (in seconds).
In Listing 17.7 a string defining the nickname common captures the remote host, identity, remote user, time, first line of request (GET) status code, and response size. An advanced configuration saves additional headers like referrer and user-agent under the nickname combined. These two nicknames are included by default in Apache and NginX. An example of the two formats is shown with sample output in Listing 17.7.
# "%h %l %u %t \"%r\" %>s %b" //common
24.114.40.54 - - [04/Aug/2020:16:38:22 +0000] "GET /css1.css HTTP/1.1" 500 635
//combined
# "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
24.114.40.54 - - [04/Aug/2020:16:38:22 +0000] "GET /css1.css
HTTP/1.1" 500 635 "http://funwebdev.com/" "Mozilla/5.0 (iPhone;
CPU iPhone OS 6_1_4 like Mac OS X) AppleWebKit/536.26 (KHTML,
like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25"For a complete list of flags, check out the mod_log_config documentation for Apache and ngx_http_log_module for NginX.16
If no maintenance of your log files is ever done, then the logs would keep accumulating and the file would grow in size until eventually it would start to impact performance or even use up all the space on the system. At about 1 MB per 10,000 requests, even a moderately busy server can generate a lot of data rather quickly.
Being aware of log file management is essential, but often you can ignore the details, since the defaults work for most situations. However, if your employer requires that log files be retained beyond what is done by default or you want to fine-tune your server’s performance, you will appreciate the ability to change the rotation policies.
There are several mechanisms that can handle log rotation, so that logs are periodically moved and deleted.17 logrotate is the daemon running on most systems by default to handle this task. For now you might see manifestation of log rotation with multiple versions of files in your log directory as seen in Listing 17.8.
total 6.2M
-rw-r--r-- 1 root root 2.0M Jul 14 03:21 access_log-19130714
-rw-r--r-- 1 root root 1.3M Jul 21 03:29 access_log-19130721
-rw-r--r-- 1 root root 1.1M Jul 28 03:33 access_log-19130728
-rw-r--r-- 1 root root 1.7M Aug 4 03:25 access_log-19130804
-rw-r--r-- 1 root root 69K Aug 4 21:07 access_logExternal monitoring is installed off of the server and checks to see that connections to required services are open. As part of a good security and administration policy, monitoring software like Nagios was illustrated back in Chapter 16. It can check for uptime and immediately notify the administrator if a service goes down. Much like internal logs, external monitoring logs can be used to generate uptime reports and other visual summaries of your server. These summaries can help you determine if the host is performing adequately in the longer term.