Configuring Error Logging

1. Setting ErrorLog Path

Directive	Values	Description
ErrorLog	`path/to/error.log`	Specifies the path to the error log file. Can be an absolute or relative path.

Example: Setting ErrorLog Path

<IfModule log_config_module>
    ErrorLog "/var/log/apache2/error.log"
</IfModule>

Note: The path must be writable by the Apache process user.

2. Configuring Log Level

Directive	Values	Description
LogLevel	`debug`, `info`, `notice`, `warn`, `error`, `crit`, `alert`, `emerg`	Sets the level of verbosity for error logs. Higher levels include lower levels.

Example: Setting Log Level to warn

LogLevel warn

Note: The debug level is typically used for development and can generate large log files.

3. Understanding Log Level Values

Level	Description	Usage
trace	Most verbose logging level, includes all internal operations and debugging details.	For development and deep troubleshooting only.
debug	Logs detailed information about internal operations and state changes.	Useful for debugging complex issues in development environments.
info	Logs general information about server operations and status changes.	Recommended for production environments to monitor normal operation.
notice	Logs events that are not errors but may require attention (e.g., configuration changes).	Good for monitoring important server events without noise from routine operations.
warn	Logs warnings about potentially problematic conditions or deprecated features.	Use in production to identify and address potential issues before they escalate.
error	Logs errors that affect server functionality or client requests.	Essential for monitoring and alerting in production systems.
crit	Logs critical errors that prevent server operation or cause data loss.	Immediate attention required when these occur in production systems.
alert	Logs conditions that require immediate action, such as system failures or security breaches.	Used for urgent alerts and emergency responses in critical systems.
emerg	Logs system-wide emergencies that require immediate shutdown or intervention.	Reserved for the most severe conditions where the server cannot continue operating safely.

Example: Setting Log Level in Apache Configuration

<IfModule log_config_module>
    LogLevel info
</IfModule>

4. Setting Per-Module Log Levels

Module	Log Level	Description
mod_rewrite	`info`	Enables logging of rewrite rules and their matching process
mod_security	`notice`	Logs security events and rule matches
mod_ssl	`info`	Logs SSL/TLS handshake details and certificate information
mod_authz_core	`debug`	Logs authorization decisions and policy evaluation steps

Example: Configuring Log Levels for mod_rewrite

<IfModule mod_rewrite.c>
    RewriteLog "/var/log/apache2/rewrite.log"
    RewriteLogLevel 3
</IfModule>

Note: The RewriteLogLevel directive accepts values from 0 (none) to 9 (most verbose). Level 3 provides a good balance of detail without excessive verbosity.

5. Configuring Per-VirtualHost Error Logs

Directive	Values	Description
ErrorLog	`logs/vhost-error.log`	Specifies the path to the error log file for a virtual host.
ErrorLogFormat	`%t %p %l %m`	Defines the format of error log entries (optional).

Example: Setting up per-virtual host error logging

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/example
    ErrorLog /var/log/apache2/example-error.log
    CustomLog /var/log/apache2/example-access.log combined
</VirtualHost>

Note: Ensure that the specified log file path has appropriate permissions for the Apache process to write to it.

6. Debugging with Trace Levels

Trace Level	Description	Usage
trace1	Basic trace information	Enable for general debugging
trace2	More detailed trace information	Use for in-depth debugging
trace3	Verbose trace information	For detailed diagnostics
trace4	Full trace information	For extensive debugging and development

Example: Enabling Trace Levels

<IfModule mod_log_config.c>
    TraceLevel 3
</IfModule>

Note: Trace levels are intended for debugging and development. They can significantly impact performance and should not be enabled in production environments.

7. Understanding Error Log Format

Component	Description	Example
Timestamp	Log entry timestamp in `YYYY-MM-DD HH:MM:SS` format	`[2026-04-05 14:30:45]`
Process ID	Server process identifier	`[pid 12345]`
Error Level	Severity level of the error (e.g., `error`, `warn`, `info`)	`[error]`
Module	Apache module that generated the log entry	`[mpm_prefork.c(234)]`
Message	Human-readable error or informational message	`client denied by server configuration: /var/www/html/secret.txt`

Example: Error Log Entry


[2026-04-05 14:30:45] [pid 12345] [error] [mpm_prefork.c(234)] client denied by server configuration: /var/www/html/secret.txt

Note: The error log format can be customized using the ErrorLogFormat directive to include additional context or change formatting.

8. Logging SSL/TLS Variables

Variable	Description	Example Value
SSL_PROTOCOL	Protocol used for the SSL/TLS connection	`TLSv1.2`
SSL_CIPHER	Cipher suite used for the connection	`ECDHE-RSA-AES256-GCM-SHA384`
SSL_SESSION_ID	Session identifier for the SSL/TLS session	`0x1234567890abcdef`
SSL_CIPHER_USEKEYSIZE	Key size used by the cipher suite	`256`
SSL_CIPHER_ALGKEYSIZE	Algorithm key size used by the cipher suite	`256`
SSL_CLIENT_M_VERSION	Client certificate version	`3`
SSL_CLIENT_M_SERIAL	Client certificate serial number	`0x1234567890abcdef`
SSL_CLIENT_S_DN	Subject distinguished name of the client certificate	`/CN=client.example.com`
SSL_CLIENT_I_DN	Issuer distinguished name of the client certificate	`/CN=ca.example.com`
SSL_CLIENT_V_START	Start date of the client certificate validity period	`20241001000000Z`
SSL_CLIENT_V_END	End date of the client certificate validity period	`20251001000000Z`

Example: Logging SSL/TLS Variables in Error Log

<IfModule mod_ssl.c>
    SSLOptions +StdEnvVars
</IfModule>

ErrorLog "logs/error_log"
LogLevel info

# Log SSL variables in error log
CustomLog "logs/ssl_access_log" "%t %{SSL_PROTOCOL}e %{SSL_CIPHER}e %{SSL_CLIENT_S_DN}e"

Note: Ensure that mod_ssl is loaded and SSLOptions +StdEnvVars is set to make SSL/TLS environment variables available for logging.

9. Using Syslog for Logging

Directive	Description	Default	Notes
ErrorLog	Specifies the file to which error messages are logged.	`logs/error_log`	Can be set to `syslog:` prefix to use syslog
SyslogIdent	Identifier used in syslog messages.	`apache`	Used to distinguish logs from different Apache instances
SyslogFacility	Syslog facility to use for logging.	`daemon`	Valid values: `auth`, `authpriv`, `daemon`, `local0` through `local7`

Example: Configuring Syslog Logging

<IfModule log_config_module>
    ErrorLog syslog:local3
    SyslogIdent apache-main
    SyslogFacility local3
</IfModule>

Note: Ensure that your system's syslog daemon (e.g., rsyslog, syslog-ng) is configured to handle messages from the specified facility.

Warning: Using syslog: in ErrorLog requires the mod_log_config module to be loaded.

Facility	Description	Use Case
`auth`	Authentication and authorization messages	Security-related logs
`daemon`	System daemons	General Apache logs
`local0` through `local7`	User-defined facilities	Custom logging for specific modules or applications

10. Configuring Forensic Logging

Directive	Description	Default	Notes
ForensicLog	Specifies the path to the forensic log file.	None	Must be set to enable forensic logging.
ForensicLogFormat	Defines the format of forensic log entries.	`%t %a %l %u %r %s %b`	Custom formats can be defined using directives.

Example: Basic Forensic Logging Configuration

ForensicLog /var/log/apache2/forensic.log
ForensicLogFormat "%t %a %l %u %r %s %b"

Note: Forensic logging is useful for debugging and analyzing server behavior in detail, particularly in production environments where standard error logs may not provide sufficient context.

11. Managing Log File Rotation

Directive	Description	Default	Notes
ErrorLog	Specifies the file to which error messages are logged.	`logs/error_log`	Can be a relative or absolute path.
CustomLog	Defines a custom log format for access logs.	None	Can be used with `LogFormat` to define custom formats.
LogFormat	Defines a named log format for use with `CustomLog`.	`%h %l %u %t "%r" %>s %b`	Used to define custom access log formats.
TransferLog	Specifies the file to which transfer logs are written (deprecated in favor of `CustomLog`).	None	Deprecated since Apache 2.0.

Example: Configuring Error Log Rotation with `rotatelogs`

# Using rotatelogs to rotate error logs daily
ErrorLog "|/usr/sbin/rotatelogs /var/log/apache2/error.log.%Y-%m-%d 86400"

Example: Using `logrotate` for Error Log Rotation

/var/log/apache2/error.log {
    daily
    rotate 5
    compress
    delaycompress
    missingok
    notifempty
    create 644 root root
}

Note: The rotatelogs utility is part of the mod_log_config module and must be installed separately.

Warning: Ensure that the log directory has appropriate permissions to allow Apache to write logs and that logrotate or similar tools are configured correctly to avoid log loss.

12. Analyzing Error Log Patterns

Pattern	Description	Example	Notes
[error]	Indicates an error-level message	`[error] [core:alert] [pid 1234] mod_rewrite.c(123): RewriteRule: Invalid regex`	Used for critical issues that prevent functionality
[notice]	Indicates a notice-level message	`[notice] Apache/2.4.57 (Unix) configured -- resuming normal operations`	Informational messages about server state changes
[warn]	Indicates a warning-level message	`[warn] [core:warn] [pid 5678] mod_rewrite.c(456): RewriteMap not found`	Non-fatal issues that may affect performance or behavior
[info]	Indicates an info-level message	`[info] [mpm_prefork:notice] [pid 9012] AH00163: Apache/2.4.57 (Unix) configured -- resuming normal operations`	General operational information

Example: Log Pattern Analysis

tail -f /var/log/apache2/error.log | grep -E '\[(error|warn)\]' | awk '{print $1, $2, $3}'

Common Log Message Components

[error], [warn], [notice], [info] — Log levels
[core:alert], [mod_rewrite:notice] — Module and severity
[pid 1234] — Process ID
mod_rewrite.c(123) — Source file and line number

Note: Log levels can be adjusted via ErrorLogFormat directive to provide more context or reduce verbosity.