Re: What's next after the common log format?

[ ... Discussion of what's after CLF for Web server logging ... ]

>The logging process could also have a GUI
>displaying charts of response times, traffic flow, how many processes are
>busy (in the fixed-children model of NetSite, HTTP 1.4, and Apache 0.7) So,
>the communication might look like this: 
>
>AN342sQ StartRequestTime: 804531212.825
>AN342sQ Method: GET
>AN342sQ URI: /foo.html
>AN342sQ HTTP-level: HTTP/1.0
>AN342sQ Accept: text/html, image/gif, */*
>AN342sQ Referrer: http://host.com/bar.html

>Thoughts?  We're busy plugging holes in Apache 0.7 right now, so we 
>haven't started building TOO much yet.

Do you think that folks need to have the log items for each request 
interleaved with other items?  I'm thinking here about the extremes of load 
(4,000,000 hits/day --> ~50 hits/sec --> 750 log entries/sec, assuming 15 
entries per request.)  Four million hits/day is a lot now, but it won't be 
much in a year.

We've actually started work in the other direction, where the server might 
accumulate the logging information for some user-specified period of time 
(several seconds, typically), and dump the information in a single I/O 
operation.  You can still do all of the fancy stuff about displaying 
response times, etc., but they'll be a few seconds behind the curve.

-andy

Received on Wednesday, 28 June 1995 21:16:40 UTC