访问日志,记录了网站访问者的信息。在一些特殊情况,我们可以通过访问日志提取出我们需要的信息。如:网站受攻击时发起源、统计访问用户大数据分布等。
一、网站访问日志
1、访问日志配置
[root@juispan ~]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf <VirtualHost *:80> DocumentRoot "/data/www/abc.com" ServerName abc.com ServerAlias www.abc.com <IfModule mod_rewrite.c> RewriteEngine on RewriteCond %{HTTP_HOST} !^abc.com$ RewriteRule ^/(.*)$ http://abc.com/$1 [R=301,L] </IfModule> ErrorLog "logs/abc.com-error_log" ##错误日志 CustomLog "logs/abc.com-access_log" common ##请求日志 </VirtualHost>
2、查看访问日志
[root@juispan ~]# ls /usr/local/apache2.4/logs/ 123.com-access_log abc.com-access_log access_log httpd.pid 123.com-error_log abc.com-error_log error_log [root@juispan ~]# tail /usr/local/apache2.4/logs/abc.com-access_log 192.168.137.100 - - [21/Jul/2017:11:38:13 +0800] "GET HTTP://abc.com/ HTTP/1.1" 403 209 192.168.137.100 - - [21/Jul/2017:12:00:52 +0800] "GET HTTP://abc.com/ HTTP/1.1" 200 7 192.168.137.100 - - [21/Jul/2017:12:00:57 +0800] "GET HTTP://www.abc.com/ HTTP/1.1" 200 7 192.168.137.100 - - [21/Jul/2017:12:01:06 +0800] "GET HTTP://abcd.com/ HTTP/1.1" 200 7
▏日志格式:
[root@juispan ~]# cat /usr/local/apache2.4/conf/httpd.conf | grep -i logformat LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined LogFormat "%h %l %u %t \"%r\" %>s %b" common
3、将common更改成combined,显示更为详细的日志格式
[root@juispan ~]# tail /usr/local/apache2.4/logs/abc.com-access_log 192.168.137.100 - - [21/Jul/2017:11:38:13 +0800] "GET HTTP://abc.com/ HTTP/1.1" 403 209 192.168.137.100 - - [21/Jul/2017:12:00:52 +0800] "GET HTTP://abc.com/ HTTP/1.1" 200 7 192.168.137.100 - - [21/Jul/2017:12:00:57 +0800] "GET HTTP://www.abc.com/ HTTP/1.1" 200 7 192.168.137.100 - - [21/Jul/2017:12:01:06 +0800] "GET HTTP://abcd.com/ HTTP/1.1" 200 7 192.168.137.1 - - [21/Jul/2017:18:07:04 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 192.168.137.1 - - [21/Jul/2017:18:07:06 +0800] "GET / HTTP/1.1" 200 7 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; .NET4.0C; .NET4.0E)" 192.168.137.1 - - [21/Jul/2017:18:07:22 +0800] "GET /1.txt HTTP/1.1" 404 203 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; .NET4.0C; .NET4.0E)"
默认情况下log日志格式为:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
其中%h 是记录访问者的IP,如果在web的前端有一层代理,那么这个%h其实就是代理机器的IP,这不是我们想要的。
在这种情况下,%{X-FORWARDED-FOR}i 字段会记录客户端真实的IP。
▏所以log日志改为:
LogFormat "%h %{X-FORWARDED-FOR}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
二、不记录静态文件
访问日志记录的大量垃圾静态文件(如图片、css、js等)访问信息,影响运维工作效率。
1、配置虚拟主机
[root@juispan ~]# vi /usr/local/apache2.4/conf/extra/httpd-vhosts.conf <VirtualHost *:80> DocumentRoot "/data/www/abc.com" ServerName abc.com ServerAlias www.abc.com ErrorLog "logs/abc.com-error_log" SetEnvIf Request_URI ".*\.gif$" img SetEnvIf Request_URI ".*\.jpg$" img SetEnvIf Request_URI ".*\.png$" img SetEnvIf Request_URI ".*\.bmp$" img SetEnvIf Request_URI ".*\.swf$" img SetEnvIf Request_URI ".*\.js$" img SetEnvIf Request_URI ".*\.css$" img ##把以gif,jpg等结尾的全部标记为img CustomLog "logs/abc.com-access_log" combined env=!img ##除了img文件,全部都记录 </VirtualHost>
2、检查重新加载
[root@juispan ~]# /usr/local/apache2.4/bin/apachectl -t Syntax OK [root@juispan ~]# /usr/local/apache2.4/bin/apachectl graceful
3、验证效果
[root@juispan ~]# curl -x127.0.0.1:80 abcd.com/123.php -I HTTP/1.1 404 Not Found Date: Fri, 21 Jul 2017 10:20:04 GMT Server: Apache/2.4.27 (Unix) PHP/7.1.6 Content-Type: text/html; charset=iso-8859-1 [root@juispan ~]# curl -x127.0.0.1:80 abcd.com/123.gif -I HTTP/1.1 404 Not Found Date: Fri, 21 Jul 2017 10:20:10 GMT Server: Apache/2.4.27 (Unix) PHP/7.1.6 Content-Type: text/html; charset=iso-8859-1 [root@juispan ~]# curl -x127.0.0.1:80 abcd.com/123.png -I HTTP/1.1 404 Not Found Date: Fri, 21 Jul 2017 10:20:17 GMT Server: Apache/2.4.27 (Unix) PHP/7.1.6 Content-Type: text/html; charset=iso-8859-1 [root@juispan ~]# tail /usr/local/apache2.4/logs/abc.com-access_log 192.168.137.100 - - [21/Jul/2017:11:38:13 +0800] "GET HTTP://abc.com/ HTTP/1.1" 403 209 192.168.137.100 - - [21/Jul/2017:12:00:52 +0800] "GET HTTP://abc.com/ HTTP/1.1" 200 7 192.168.137.100 - - [21/Jul/2017:12:00:57 +0800] "GET HTTP://www.abc.com/ HTTP/1.1" 200 7 192.168.137.100 - - [21/Jul/2017:12:01:06 +0800] "GET HTTP://abcd.com/ HTTP/1.1" 200 7 192.168.137.1 - - [21/Jul/2017:18:07:04 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 192.168.137.1 - - [21/Jul/2017:18:07:06 +0800] "GET / HTTP/1.1" 200 7 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; .NET4.0C; .NET4.0E)" 192.168.137.1 - - [21/Jul/2017:18:07:22 +0800] "GET /1.txt HTTP/1.1" 404 203 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; .NET4.0C; .NET4.0E)" 127.0.0.1 - - [21/Jul/2017:18:20:04 +0800] "HEAD HTTP://abcd.com/123.php HTTP/1.1" 404 - "-" "curl/7.29.0" ##可以看到过滤后的效果了
三、访问日志切割
网站每天都在被访问,会记录大量的日志信息。单个大日志文件不方便运维人员的查看,而且还不方便清理过期日志。通过切割日志能很好的解决这个问题。
1、配置虚拟主机
[root@juispan ~]# cat /usr/local/apache2.4/conf/extra/httpd-vhosts.conf | grep -i customlog CustomLog "|/usr/local/apache2.4/bin/rotatelogs -l logs/abc.com-access_%Y%m%d.log 86400" combined env=!img ##工具名为:rotatelogs;-l:以当前系统时间为基准
2、检查重新加载
[root@juispan ~]# /usr/local/apache2.4/bin/apachectl -t Syntax OK [root@juispan ~]# /usr/local/apache2.4/bin/apachectl graceful
3、测试效果
[root@juispan ~]# curl -x127.0.0.1:80 abcd.com/123.php -I HTTP/1.1 404 Not Found Date: Fri, 21 Jul 2017 10:32:07 GMT Server: Apache/2.4.27 (Unix) PHP/7.1.6 Content-Type: text/html; charset=iso-8859-1 [root@juispan ~]# ls /usr/local/apache2.4/logs/ 123.com-access_log abc.com-access_20170721.log abc.com-error_log error_log 123.com-error_log abc.com-access_log access_log httpd.pid
可以看到生成了一个新的日志文件,后期可以制作一个任务计划,删除过期的日志文件,以防磁盘空间不足。