Recipe 13.5. Customizing Pound s Logging with cronolog

Recipe 13.5. Customizing Pound's Logging with cronolog

Problem

You're using Pound as a software load balancer. By default, Pound logs to syslog. This is probably not where you want your web application's access logs, especially if your site gets a lot of traffic. You want a way to have Pound log to a directory of your choosing, just as you have with Apache or Lighttpd.

Solution

cronolog is a useful utility that takes input and writes it to logfiles named according to a string based on the current date and time. By default, Pound sends its logs to syslog, but it can be configured to send its logs to standard error instead. Once the default behavior has been overridden, you can pipe Pound's output to cronolog, giving you total control over where your logs are saved.

The first step is to install cronolog. Install it on a Debian-based system with:

$ apt-get update $ apt-get install cronolog

Alternatively, you can download the source and build it yourself:

$ wget http://cronolog.org/download/cronolog-1.6.2.tar.gz $ tar xvzf cronolog-1.6.2.tar.gz $ cd cronolog-1.6.2 $ ./configure --prefix=/usr/local $ make $ sudo make install

Once you have cronolog installed, you can test it by sending it some output from the command line with echo; for example:

$ echo "This is a test." | /usr/bin/cronolog \ > /var/log/www/%Y/access.%m-%d-%y.log

Running this command demonstrates how cronolog accepts input and creates logfiles based on a template string consisting of the current date and time. In this case, cronolog receives the output of the echo command and creates a directory named 2006 under /var/log/www, containing a file called access.07-17-06.log.

$ cat /var/log/www/2006/access.07-17-06.log This be a test.

The date template format string is the same as the Unix date command (which in turn is the same as your system C library's implementation of the strftime). See the cronolog manpage for a full listing of format options.

The idea behind using cronolog with Pound is basically the same. You want to pipe the output of Pound directly to cronolog. To get at Pound's logs, you have to disable its built-in logging behavior that sends all of its output to syslog. To do this, you reconfigure Pound, passing the --disable-log to the configure command. (Unfortunately, you can't change the logfile destination by editing a runtime configuration file.)

$ tar xvzf Pound-2.0.9.tgz $ cd Pound-2.0.9 $ ./configure --disable-log $ make $ sudo make install

The final step is to pipe Pound's output to cronolog. On a Debian system, you can modify Pound's init script. Basically, wherever Pound is started, you add an additional pipe string to the cronolog command. Here's our Pound init script:

/etc/init.d/pound:

#! /bin/sh PATH=/sbin:/bin:/usr/sbin:/usr/bin DAEMON=/usr/local/sbin/poun CRONOLOG='/usr/bin/cronolog /var/log/www/pound/%Y/access.%m-%d-%y.log' NAME=pound DESC=pound PID=/var/run/$NAME.pid test -f $DAEMON || exit 0 set -e # check if pound is configured or not if [ -f "/etc/default/pound" ] then   . /etc/default/pound   if [ "$startup" != "1" ]   then     echo -n "pound won't start unconfigured. configure & set startup=1"     echo "in /etc/default/pound"     exit 0     fi else   echo "/etc/default/pound not found"   exit 0   fi case "$1" in    start)       echo -n "Starting $DESC: "     start-stop-daemon --start --quiet --exec $DAEMON | $CRONOLOG &     echo "$NAME."     ;;   stop)     echo -n "Stopping $DESC: "     start-stop-daemon --oknodo --pidfile $PID --stop --quiet \                                                      --exec $DAEMON      echo "$NAME."     ;;   restart|force-reload)     echo -n "Restarting $DESC: "     start-stop-daemon --pidfile $PID --stop --quiet --exec $DAEMON      sleep 1      start-stop-daemon --start --quiet --exec $DAEMON | $CRONOLOG &     echo "$NAME."     ;;   *)     N=/etc/init.d/$NAME     # echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2     echo "Usage: $N {start|stop|restart|force-reload}" >&2     exit 1       ;; esac exit 0

To avoid some repetition, we store the call to cronolog in a bash variable named CRONOLOG. Then, in each place where Pound is called, append | $CRONOLOG & (a pipe, the output of the CRONOLOG variable, and an ampersand to put the process into the background).

Now, start Pound with the init script:

$ sudo /etc/init.d/pound start

Discussion

With the configuration outlined in the solution, Pound logs its Apache-style logs (Pound LogLevel 3) to the file /var/log/www/pound/2006/access.07-17-06.log:

blog.tupleshop.com 24.60.34.25 - - [11/Jul/2006:10:51:15 -0700]      "GET /favicon.ico HTTP/1.1" 200 1406 "" "Mozilla/5.0 (Macintosh; U;      PPC Mac OS X Mach-O; en-US; rv:1.8.0.4) Gecko/20060508      Firefox/1.5.0.4" blog.tupleshop.com 67.121.136.191 - - [11/Jul/2006:10:55:12 -0700]      "GET /images/figures/pound-deploy.pdf HTTP/1.1" 200 45041 ""      "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en) AppleWebKit/418.8      (KHTML, like Gecko) Safari/419.3" blog.tupleshop.com 68.142.33.136 - - [11/Jul/2006:10:55:50 -0700]      "GET /images/figures/pound-deploy.pdf HTTP/1.1" 200 45041      "http://www.oreillynet.com/ruby/blog/" "Mozilla/5.0 (Macintosh; U;      PPC Mac OS X; en) AppleWebKit/418 (KHTML, like Gecko)      NetNewsWire/2.1"

This logfile format is one field away from Apache's "common" logfile format. The first field is the additional one; specifying the host portion of the request. Pound lets you opt to leave this field off, in which case you can feed the resultant logs directly to a logfile analysis tool such as AWStats. To do this, specifying a loglevel of 4, and Pound will omit the virtual host information.

One of the benefits of using cronolog is that you get log rotation for free. In other words, you don't have to stop your web server periodically while you rotate out large logfiles for fresh (empty) ones.