You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Christian Folini <ch...@netnea.com> on 2011/03/30 15:23:57 UTC

A timestamp for mod_log_forensic (?)

Hi there,

Mod_log_forensic is saving my day while debugging a crashing 
apache. But matching the right request with the crash and its 
corefile is difficult.

Ideally the log would show me only the active requests 
at the moment the server died. But in my case things are a bit
more difficult. The delta between incoming requests and those
finished is bigger.

So I matched the entries of the finished requests with the
access log entries to get a more or less accurate timestamp
for all those requests that never finished, so I could match
them with the crash. But that is very complicated of course.

So, is there anything speaking against a timestamp for the 
forensic log?

The format right now looks as follows
+yQtJf8CoAB4AAFNXBIEAAAAA|GET /manual/de/images/down.gif HTTP/1.1|Host:localhost%3a8080| etc.

A format with a microtimestamp could look as follows:

+956166333.123456|yQtJf8CoAB4AAFNXBIEAAAAA|GET /manual/de/ ...

or

+yQtJf8CoAB4AAFNXBIEAAAAA|956166333.123456|GET /manual/de/ ...

or

+yQtJf8CoAB4AAFNXBIEAAAAA|GET /manual/de/ ... |956166333.123456|


Best regards,

Christian Folini

-- 
Christian Folini - <ch...@netnea.com>

Re: A timestamp for mod_log_forensic (?)

Posted by Christian Folini <ch...@netnea.com>.
On Wed, Mar 30, 2011 at 03:32:27PM +0200, Graham Leggett wrote:
> Have you taken a look at Jeff's mod_whatkilledus?
> 
> http://people.apache.org/~trawick/exception_hook.html

mod_whatkilledus will be one of the next steps in my debugging,
if mod_forensic won't do.

Still I think I could add a small timestamp patch for 
mod_log_forensic for future convenience.

regs,

Christian

-- 
Christian Folini - <ch...@netnea.com>

Re: A timestamp for mod_log_forensic (?)

Posted by Graham Leggett <mi...@sharp.fm>.
On 30 Mar 2011, at 3:23 PM, Christian Folini wrote:

> Mod_log_forensic is saving my day while debugging a crashing
> apache. But matching the right request with the crash and its
> corefile is difficult.

Have you taken a look at Jeff's mod_whatkilledus?

http://people.apache.org/~trawick/exception_hook.html

Regards,
Graham
--