From adc67fa41225b82d63828f6a7bb7c187783125ca Mon Sep 17 00:00:00 2001 From: Christopher Powell Date: Thu, 14 Nov 2002 22:52:56 +0000 Subject: More documentation work on the way to final 1.17 release. Additional work on the Makefile. --- Documentation/documentation.lyx | 3482 ++++++++++++++++++++++++++++----------- 1 file changed, 2549 insertions(+), 933 deletions(-) (limited to 'Documentation/documentation.lyx') diff --git a/Documentation/documentation.lyx b/Documentation/documentation.lyx index 48c3968..ecee913 100644 --- a/Documentation/documentation.lyx +++ b/Documentation/documentation.lyx @@ -5,6 +5,7 @@ \inputencoding default \fontscheme default \graphics default +\float_placement !hptb \paperfontsize 10 \spacing single \papersize letterpaper @@ -12,8 +13,6 @@ \use_geometry 1 \use_amsmath 0 \paperorientation portrait -\paperwidth 8.5in -\paperheight 11in \leftmargin 1in \topmargin 0.5in \rightmargin 1in @@ -22,7 +21,7 @@ \tocdepth 3 \paragraph_separation indent \defskip medskip -\quotes_language swedish +\quotes_language english \quotes_times 2 \papercolumns 1 \papersides 1 @@ -33,10 +32,7 @@ Installing and Running mod_log_sql \layout Author -Christopher Powell -\layout Date - -11/13/02 +Christopher Powell, \layout Standard \pagebreak_bottom @@ -431,8 +427,6 @@ Unpack the archive into a working directory. \end_inset Edit Makefile for your system. -\newline - \begin_deeper \layout Standard @@ -588,7 +582,7 @@ Install your httpd binary. Configuration \layout Subsection -Preparing MySQL +Preparing MySQL for logging \layout Standard You have to prepare the database to receive data from mod_log_sql, and set @@ -673,7 +667,7 @@ Then restart MySQL. \end_deeper \layout Subsection -Preparing Apache +A very basic logging setup in Apache \layout Enumerate Tell the module what database to use and the appropriate authentication @@ -689,8 +683,12 @@ EXAMPLE: Use the MySQL database called "apachelogs" running on "dbmachine.foo.co So, edit httpd.conf and insert the following lines somewhere AFTER any LoadModule / AddModule statements. - Make sure these statements are "global," i.e. - not inside any VirtualHost stanza. + +\emph on +Make sure these statements are "global," i.e. + not inside any VirtualHost stanza +\emph default +. \layout LyX-Code LogSQLDatabase apachelogs @@ -700,15 +698,20 @@ LogSQLLoginInfo dbmachine.foo.com loguser l0gger \layout LyX-Code LogSQLCreateTables on -\end_deeper -\layout Enumerate +\layout Standard If your database resides on localhost instead of another host, specify the MySQL server's socket file as follows: -\begin_deeper \layout LyX-Code LogSQLSocketFile /your/path/to/mysql.sock +\layout Standard + +If your database is listening on a port other than 3306, specify the correct + TCP port as follows: +\layout LyX-Code + +LogSQLTCPPort 1234 \end_deeper \layout Enumerate @@ -724,20 +727,21 @@ access_log by inserting a LogSQLTransferLogTable directive. (The LogSQLTransferLogTable directive is the minimum required to log -- - other directives simply tune the module's behavior.) + other directives that you'll learn about later simply tune the module's + behavior.) \begin_deeper \layout LyX-Code \layout LyX-Code -[snip] + [snip] \layout LyX-Code -LogSQLTransferLogTable access_log + LogSQLTransferLogTable access_log \layout LyX-Code -[snip] + [snip] \layout LyX-Code @@ -752,7 +756,7 @@ Restart apache. \end_deeper \layout Subsection -Testing the module +Testing the basic setup \layout Enumerate Load your web site in a browser to trigger some hits, then confirm that @@ -779,7 +783,7 @@ You now have basic functionality. If you do not see any entries in the access_log, then something is preventing the inserts from happening. - This problem could be caused by several things: + This problem could be caused by several things: \begin_deeper \layout Itemize @@ -815,409 +819,270 @@ You can now activate the advanced features of mod_log_sql. These are all described in the next section. \layout Subsection -Configuration directive reference +How to tune logging with run-time directives \layout Subsubsection -LogSQLLoginInfo -\layout LyX-Code +Instructing the module what to log +\layout Standard +The LogSQLTransferLogFormat directive tells the module which information + to send to the database. + This directive resembles -- but is not identical to -- the Apache LogFormat + directive. + For each virtual host that you want to enable SQL logging, insert a LogSQLTrans +ferLogFormat directive into the VirtualHost stanza. +\layout Standard -\series bold -MANDATORY -\series default - -\layout LyX-Code +After LogSQLTransferLogFormat you supply a string of characters that tell + the module what to log. + In the configuration directive reference (section +\begin_inset LatexCommand \ref{sec:ConfRef} -Syntax: LogSQLLoginInfo host user password -\layout LyX-Code +\end_inset -Example: LogSQLLoginInfo foobar.baz.com logwriter passw0rd +) there is a table which clearly defines all the possible things to log. + Let's say you only wanted to log only the request time, the remote host, + and the request; you'd use: \layout LyX-Code -Context: server config -\layout Quote - -Defines the general parameters of the MySQL host to which you will be logging. - host is the hostname or IP address of the MySQL machine. - user is the MySQL userid (not a Unix userid!) with INSERT privileges on - the table defined in LogSQLTransferLogTable. - password is that user's password. - This is defined only once in the httpd.conf file. -\layout Subsubsection +LogSQLTransferLogFormat HUS +\layout Standard -LogSQLDatabase +A more appropriate string to use is \layout LyX-Code +LogSQLTransferLogFormat AbHhmRSsTUuv +\layout Standard -\series bold -MANDATORY -\layout LyX-Code +which logs all the information required to be compatible with the Combined + Log Format (CLF). +\layout Standard -Syntax: LogSQLDatabase database -\layout LyX-Code +If you don't choose to log everything that is available, that's fine. + The table in your database will have unused columns that will simply contain + NULL and do not cause issues. +\layout Standard -Example: LogSQLDatabase loggingdb -\layout LyX-Code +Some directives need a little extra configuration: +\layout Itemize -Context: server config -\layout Quote +If you specify 'c' to indicate that you want to log the cookie value, you + need to also tell the module which cookie you want with LogSQLWhichCookie + -- after all, there could be many cookies associated with a given request. + Fail to specify LogSQLWhichCookie, and no cookie information at all will + be logged. + +\layout Itemize -Defines the database that is used for logging. - database must be operating on the MySQL host defined in LogSQLLoginInfo. - This is defined only once in the httpd.conf file. +If you specify 'M' to indicate that you want to log the machine ID, you + need to also instruct the module this machine's identifier using the LogSQLMach +ineID directive. + Fail to specify LogSQLMachineID, and a simple '-' character will be logged + in the machine_id column. \layout Subsubsection -LogSQLTransferLogTable -\layout LyX-Code +Instructing the module what NOT to log +\layout Standard +Two +\begin_inset Quotes eld +\end_inset -\series bold -MANDATORY -\layout LyX-Code +ignore +\begin_inset Quotes srd +\end_inset -Syntax: LogSQLTransferLogTable table-name -\layout LyX-Code + directives allow you to specify things that the module should not log. + This can be very handy for a variety of reasons, such as keeping your database + as uncluttered as possible, keeping your statistics free of unneeded numbers, + etc. +\layout Standard -Example: LogSQLTransferLogTable access_log_table -\layout LyX-Code +You are able to tell the module to ignore based on LogSQLRemhostIgnore and + LogSQLRequestIgnore. + A good way to use LogSQLRemhostIgnore is to prevent the module from logging + the traffic that your internal hosts generate. + LogSQLRequestIgnore is great for preventing things like requests for favicon.ico + from cluttering up your database, as well as the various requests that + worms make, etc. +\layout Standard -Context: virtual host -\layout Quote +You can specify a series of strings after each directive. + Do not use any type of globbing or regular-expression syntax -- each string + is considered a match if it is a substring of the larger request or remote-host. + In other words, if you want to match +\begin_inset Quotes eld +\end_inset -Defines which table is used for logging of Apache's transfers; this is analogous - to Apache's TransferLog directive. - table-name must be a valid table within the database defined in LogSQLDatabase. -\layout Quote +host1.corp.foo.com +\begin_inset Quotes srd +\end_inset -This directive is not necessary if you declare LogSQLMassVirtualHosting - On, since that directive activates dynamically-named tables. - If you attempt to use LogSQLTransferLogTable at the same time a warning - will be logged and it will be ignored, since LogSQLMassVirtualHosting takes - priority. -\layout Subsubsection + and +\begin_inset Quotes eld +\end_inset -LogSQLRequestIgnore -\layout LyX-Code +host2.dmz.foo.com +\begin_inset Quotes srd +\end_inset -Syntax: LogSQLRequestIgnore req1 req2 req3 ... - reqN +, simply specify: \layout LyX-Code -Example: LogSQLRequestIgnore root.exe cmd.exe default.ida favicon.ico -\layout LyX-Code +LogSQLRemhostIgnore foo.com +\layout Standard -Context: virtual host -\layout Quote +A great way to catch the vast majority of worm-attack requests and prevent + them from being logged is to specify: +\layout LyX-Code -Lists a series of strings that, if present in the URI, will cause that request - NOT to be logged. - This directive is useful for cutting down on log clutter when you KNOW - that you do not want to log requests for certain objects. - (The example above is a genuinely useful one; it will prevent logging of - many common Microsoft-based worm intrusion attempts, as well as those ridiculou -s requests for the favicon.) -\layout Quote +LogSQLRequestIgnore root.exe cmd.exe default.ida +\layout Subsection -Each string is separated by a space, and NO regular expressions or globbing - are allowed. - Each string is evaluated as a substring of the URI using strstr(). +Advanced logging scenarios \layout Subsubsection -LogSQLRemhostIgnore -\layout LyX-Code -Syntax: LogSQLRemhostIgnore host1 host2 host3 ... - hostN -\layout LyX-Code +\begin_inset LatexCommand \label{secMulTable} -Example: LogSQLRemhostIgnore localnet.com -\layout LyX-Code +\end_inset -Context: virtual host -\layout Quote +Logging many-to-one data in separate tables +\layout Standard -Lists a series of strings that, if present in the REMOTE_HOST, will cause - that request NOT to be logged. - This directive is useful for cutting down on log clutter when you KNOW - that you do not want to log requests from certain hosts, such as your own - internal network machines. -\layout Quote +A given HTTP request can have a one-to-many relationship with certain kinds + of data. + For example, a single HTTP request can have 4 cookies, 3 headers and 5 + mod_gzip notes associated with it. + mod_log_sql is capable of logging these relationships due to the elegance + of SQL relational data. +\layout Standard -Each string is separated by a space, and NO regular expressions or globbing - are allowed. - Each string is evaluated as a substring of the REMOTE_HOST using strstr(). -\layout Subsubsection +You already have a single table containing access requests. + One of the columns in that table is 'id' which contains the unique request + ID supplied by the standard Apache module mod_unique_id (assuming you compile + in that module and employ the LogSQLTransferLogFormat character 'I'). + Each request gets a unique ID that can be thought of as a primary key within + the database. +\layout Standard -LogSQLRefererIgnore -\layout LyX-Code +So, let's add several new tables: a notes table, a cookies table, and tables + for inbound and outbound headers. + We have a certain request, let's say its unique ID is +\begin_inset Quotes eld +\end_inset -Syntax: LogSQLRefererIgnore ref1 ref2 ref3 ... - refN -\layout LyX-Code +XYZ123 +\begin_inset Quotes erd +\end_inset -Example: LogSQLRefererIgnore google.com -\layout LyX-Code +. + Within each separate table will be multiple entries with that request ID: + several cookie entries, several header entries, etc. + Something like this: +\layout Standard -Context: virtual host -\layout Quote +\begin_float tab +\layout Caption -Lists a series of strings that, if present in the HTTP_REFERER, will cause - that request NOT to be logged. - This directive is useful for cutting down on log clutter when you know - that you do not want to log requests from certain referers. -\layout Quote -Each string is separated by a space, and NO regular expressions or globbing - are allowed. - Each string is evaluated as a substring of the HTTP_REFERER using strstr(). -\layout Subsubsection +\begin_inset LatexCommand \label{tblAcc} -LogSQLWhichCookie -\layout LyX-Code +\end_inset -Syntax: LogSQLWhichCookie cookiename -\layout LyX-Code +access_log +\layout Standard +\align center -Example: LogSQLWhichCookie Clicks -\layout LyX-Code +\begin_inset Tabular + + + + + + + +\begin_inset Text -Default: None. - You must set this if you wish to capture cookies. -\layout LyX-Code +\layout Standard -Context: virtual host -\layout Quote +id +\end_inset + + +\begin_inset Text -In HTTP, cookies have names to distinguish them from each other. - Using mod_usertrack, for example, you can give your user-tracking cookies - a name with the CookieName directive. -\layout Quote +\layout Standard -If you have activated cookie logging in LogSQLTransferLogFormat, then LogSQLWhic -hCookie tells mod_log_sql which cookie to log. - This is useful because many times you will be setting and receiving more - than one cookie from a client; without this directive you'd be unable to - choose which cookie is your mod_usertrack cookie. -\layout Quote +remote_host +\end_inset + + +\begin_inset Text -Note: although this was intended for people who are using mod_usertrack - to set user-tracking cookies, you aren't restricted in any way. - You can choose which cookie you wish to log to the database, and it doesn't - necessarily have to have anything to do with mod_usertrack. -\layout Subsubsection +\layout Standard -LogSQLCreateTables -\layout LyX-Code +request_uri +\end_inset + + + + +\begin_inset Text -Syntax: LogSQLCreateTables flag -\layout LyX-Code +\layout Standard -Example: LogSQLCreateTables On -\layout LyX-Code +XYZ123 +\end_inset + + +\begin_inset Text -Default: Off -\layout LyX-Code +\layout Standard -Context: server config -\layout Quote +foo.bar.com +\end_inset + + +\begin_inset Text -mod_log_sql now has the ability to create its tables on-the-fly. - The advantage to this is convenience: you don't have to execute any SQL - by hand to prepare the table. - This is especially helpful for people with lots of virtual hosts (who should - also see the LogSQLMassVirtualHosting directive). -\layout Quote +\layout Standard -There is a slight disadvantage: if you wish to activate this feature, then - the user specified by LogSQLLoginInfo must have CREATE privileges on the - database. - In an absolutely paranoid, locked-down situation you may only want to grant - your mod_log_sql user INSERT privileges on the database; in that situation - you are unable to take advantage of LogSQLCreateTables. - But most people -- even the very security-conscious -- will find that granting - CREATE on the logging database is reasonable. -\layout Quote +/index.html +\end_inset + + + -This is defined only once in the httpd.conf file. -\layout Subsubsection +\end_inset -LogSQLMassVirtualHosting -\layout LyX-Code -Syntax: LogSQLMassVirtualHosting flag -\layout LyX-Code +\end_float +\begin_float tab +\layout Caption -Example: LogSQLMassVirtualHosting On -\layout LyX-Code -Default: Off -\layout LyX-Code +\begin_inset LatexCommand \label{tblNotes} -Context: server config -\layout Quote - -If you administer a site hosting many, many virtual hosts then this option - will appeal to you. - If you activate LogSQLMassVirtualHosting then several things happen: -\begin_deeper -\layout Itemize - -the on-the-fly table creation feature is activated automatically -\layout Itemize - -the transfer log table name is dynamically set from the virtual host's name - (example: a virtual host www.grubbybaby.com gets logged to table access_www_grubb -ybaby_com) -\layout Itemize - -which, in turn, means that each virtual host logs to its own segregated - table. - Because there is no data shared between virtual servers you can grant your - users access to the tables they need; they will be unable to view others' - data. -\end_deeper -\layout Quote - -This is a huge boost in convenience for sites with many virtual servers. - Activating LogSQLMassVirtualHosting obviates the need to create every virtual - server's table and provides more granular security possibilities. -\layout Quote - -This is defined only once in the httpd.conf file. -\layout Subsubsection - -LogSQLPreserveFile -\layout LyX-Code - -Syntax: LogSQLPreserveFile filename -\layout LyX-Code - -Example: LogSQLPreserveFile offline-preserve -\layout LyX-Code - -Default: mysql-preserve (in /tmp) -\layout LyX-Code - -Context: virtual host -\layout Quote - -mod_log_sql writes queries to this local preserve file in the event that - it cannot reach the database, and thus ensures that your high-availability - web frontend does not lose logs during a temporary database outage. - This could happen for a number of reasons: the database goes offline, the - network breaks, etc. - You will not lose entries since the module has this backup. - The file consists of a series of SQL statements that can be imported into - your database at your convenience; furthermore, because the SQL queries - contain the access timestamps you do not need to worry about out-of-order - data after the import. -\layout Quote - -For security purposes the name you supply will be prepended with "/tmp/" - to force creation of the file in /tmp. -\layout Quote - -If you do not define LogSQLPreserveFile then all virtual servers will log - to the same default preserve file (/tmp/mysql-preserve). - You can redefine this on a virtual-host basis in order to segregate your - preserve files if you desire. - Note that segregation is not really necessary, as the SQL statements that - are written to the preserve file already distinguish between different - virtual hosts. -\layout Quote - -The module will log to error-log if/when it notices a database outage, and - upon database return. - You will therefore know when the preserve file is being used, although - it is your responsibility to import the file. -\layout Quote - -The file does not need to be created in advance. - It is safe to remove or rename the file without interrupting Apache, as - the module closes the filehandle immediately after completing the write. - The file is created with the user & group ID of the running Apache process - (e.g. - 'nobody' on many Linux distributions). -\layout Subsubsection - -LogSQLSocketFile -\layout LyX-Code - -Syntax: LogSQLSocketFile filename -\layout LyX-Code - -Example: LogSQLSocketFile /tmp/mysql.sock -\layout LyX-Code - -Default: /var/lib/mysql/mysql.sock -\layout LyX-Code - -Context: server config -\layout Quote - -At Apache runtime you can specify the MySQL socket file to use. - Set this once in your main server config to override the default value. - This value is irrelevant if your database resides on a separate machine. -\layout Quote - -mod_log_sql will automatically employ the socket for db communications if - the database resides on the local host. - If the db resides on a separate host the module will automatically use - TCP/IP. - This is a function of the MySQL API and is not user-configurable. -\layout Subsubsection - -LogSQLTransferLogFormat -\layout LyX-Code - -Syntax: LogSQLTransferLogFormat format-string -\layout LyX-Code - -Example: LogSQLTransferLogFormat huSUTv -\layout LyX-Code - -Default: AbHhmRSsTUuv -\layout LyX-Code - -Context: virtual host -\layout Quote - -Each character in the format-string defines an attribute of the request - that you wish to log. - The default logs the information required to create Combined Log Format - logs, plus several extras. - Here is the full list of allowable keys, which sometimes resemble their - Apache counterparts, but do not always: -\layout Quote +\end_inset +notes_log +\layout Standard +\align center \begin_inset Tabular - - - - - - + + + + - -\begin_inset Text - -\layout Standard - - -\series bold -Character -\end_inset - \begin_inset Text \layout Standard - -\series bold -What is this? +id \end_inset @@ -1225,55 +1090,51 @@ What is this? \layout Standard - -\series bold -MySQL DB field +item \end_inset - + \begin_inset Text \layout Standard - -\series bold -Recommended column type +val \end_inset + + \begin_inset Text \layout Standard - -\series bold -Example +XYZ123 \end_inset - - \begin_inset Text \layout Standard -A +mod_gzip_result \end_inset - + \begin_inset Text \layout Standard -User agent +OK \end_inset + + \begin_inset Text \layout Standard -agent +XYZ123 \end_inset @@ -1281,83 +1142,77 @@ agent \layout Standard -varchar(255) +mod_gzip_compression_ratio \end_inset - + \begin_inset Text \layout Standard -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 4.0) +69 \end_inset - - -\begin_inset Text - -\layout Standard + -b \end_inset - - -\begin_inset Text + +\end_float \layout Standard -Bytes transfered -\end_inset - - -\begin_inset Text +\begin_float tab +\layout Caption -\layout Standard -bytes_sent +\begin_inset LatexCommand \label{tblHdr} + \end_inset - - -\begin_inset Text +headers_log \layout Standard +\align center -int unsigned -\end_inset - +\begin_inset Tabular + + + + + + \begin_inset Text \layout Standard -32561 +id \end_inset - - \begin_inset Text \layout Standard -c +item \end_inset - + \begin_inset Text \layout Standard -Text of cookie +val \end_inset + + \begin_inset Text \layout Standard -cookie +XYZ123 \end_inset @@ -1365,15 +1220,15 @@ cookie \layout Standard -varchar(255) +Content-Type \end_inset - + \begin_inset Text \layout Standard -Apache=sdyn.fooonline.net.130051007102700823 +text/html \end_inset @@ -1383,7 +1238,7 @@ Apache=sdyn.fooonline.net.130051007102700823 \layout Standard -f +XYZ123 \end_inset @@ -1391,22 +1246,25 @@ f \layout Standard +Accept-Encoding \end_inset - + \begin_inset Text \layout Standard -request_file +gzip, deflate \end_inset + + \begin_inset Text \layout Standard -varchar(255) +XYZ123 \end_inset @@ -1414,24 +1272,25 @@ varchar(255) \layout Standard +Expires \end_inset - - - + \begin_inset Text \layout Standard -H +Tue, 28 May 2002 10:00:18 GMT \end_inset + + \begin_inset Text \layout Standard -HTTP request protocol +XYZ123 \end_inset @@ -1439,83 +1298,76 @@ HTTP request protocol \layout Standard -request_protocol +Cache-Control \end_inset - + \begin_inset Text \layout Standard -varchar(10) +max-age=86400 \end_inset - -\begin_inset Text + + + +\end_inset + +\end_float \layout Standard -HTTP/1.1 +As you can see in tables +\begin_inset LatexCommand \ref{tblAcc} + \end_inset - - - - -\begin_inset Text -\layout Standard +, +\begin_inset LatexCommand \ref{tblNotes} -h \end_inset - - -\begin_inset Text -\layout Standard + and +\begin_inset LatexCommand \ref{tblHdr} -Name of remote host \end_inset - - -\begin_inset Text - -\layout Standard -remote_host +, you have a many-to-one relationship for request XYZ123: one access has + two associated notes and four associated headers. + You can extract this data easily using the power of SQL's +\begin_inset Quotes eld \end_inset - - -\begin_inset Text - -\layout Standard -varchar(50) +select +\begin_inset Quotes erd \end_inset - - -\begin_inset Text -\layout Standard + statement and table joins. + To see the notes associated with a particular request: +\layout LyX-Code -blah.foobar.com -\end_inset - - - - -\begin_inset Text +select a.remote_host, a.request_uri, n.item, n.val from access_log a, notes_log + n where a.id=n.id and a.id='PPIDskBRH30AAGPtAsg'; +\layout LyX-Code \layout Standard +\align center -I -\end_inset - +\begin_inset Tabular + + + + + + + \begin_inset Text \layout Standard -Ident user info +remote_host \end_inset @@ -1523,23 +1375,23 @@ Ident user info \layout Standard -remote_logname +request_uri \end_inset - + \begin_inset Text \layout Standard -varchar(50) +item \end_inset - + \begin_inset Text \layout Standard -bobby +val \end_inset @@ -1549,15 +1401,7 @@ bobby \layout Standard -m -\end_inset - - -\begin_inset Text - -\layout Standard - -HTTP request method +zerberus.aiacs.net \end_inset @@ -1565,41 +1409,33 @@ HTTP request method \layout Standard -request_method +/mod_log_sql/style_1.css \end_inset - + \begin_inset Text \layout Standard -varchar(6) +mod_gzip_result \end_inset - + \begin_inset Text \layout Standard -GET +DECLINED:EXCLUDED \end_inset - - -\begin_inset Text - -\layout Standard - -P -\end_inset - + \begin_inset Text \layout Standard -httpd child PID +zerberus.aiacs.net \end_inset @@ -1607,199 +1443,1118 @@ httpd child PID \layout Standard -child_pid +/mod_log_sql/style_1.css \end_inset - + \begin_inset Text \layout Standard -smallint unsigned +mod_gzip_compression_ratio \end_inset - + \begin_inset Text \layout Standard -3215 +0 \end_inset - - -\begin_inset Text - -\layout Standard + -p \end_inset - - -\begin_inset Text -\layout Standard -httpd port -\end_inset - - -\begin_inset Text +\layout LyX-Code + +\layout LyX-Code \layout Standard -server_port -\end_inset - - -\begin_inset Text +In order to use this capability of mod_log_sql, you must do several things: +\layout Itemize -\layout Standard +Compile mod_unique_id into Apache (statically or as a DSO). + mod_log_sql employs the unique request ID that mod_unique_id provides in + order to key between the separate tables. + You can still log the data without mod_unqiue_id, but it will be completely + uncorrelated and you will have no way to discern any meaning. +\layout Itemize -smallint unsigned -\end_inset - - -\begin_inset Text +Create the appropriate tables. + This will be done for you if you permit mod_log_sql to create its own tables, + or if you use the enclosed create_tables.sql script. +\layout Itemize -\layout Standard +Create a SQL index on the +\begin_inset Quotes eld +\end_inset -80 +id +\begin_inset Quotes erd \end_inset - - - - -\begin_inset Text -\layout Standard + column. + Without this index, table joins will be deathly slow. + I recommend you consult the MySQL documentation on the proper way to create + a column index if you are not familiar with this operation. +\layout Itemize -R -\end_inset - - -\begin_inset Text +Within each appropriate VirtualHost stanza, use the LogSQLWhich* and LogSQL*LogT +able directives to tell the module what and where to log the data. + In the following example, I have specified a name for the notes table that + is different from the default, whereas I have left the other table names + at their defaults. + I then specified the cookies, headers and notes that interest me. +\layout LyX-Code -\layout Standard + +\layout LyX-Code -Referer -\end_inset - - -\begin_inset Text + (snip) +\layout LyX-Code -\layout Standard + LogSQLNotesLogTable notestable +\layout LyX-Code -referer -\end_inset - - -\begin_inset Text + LogSQLWhichCookies bluecookie redcookie greencookie +\layout LyX-Code -\layout Standard + LogSQLWhichNotes mod_gzip_result mod_gzip_compression_ratio +\layout LyX-Code -varchar(255) -\end_inset - - -\begin_inset Text + LogSQLWhichHeadersOut Expires Content-Type Cache-Control +\layout LyX-Code -\layout Standard + LogSQLWhichHeadersIn UserAgent Accept-Encoding Host +\layout LyX-Code -http://www.biglinkstoyou.com/linkpage.html -\end_inset - - - - -\begin_inset Text + (snip) +\layout LyX-Code -\layout Standard + +\layout LyX-Code -r -\end_inset - - -\begin_inset Text +\layout Subsection -\layout Standard -Request in full form +\begin_inset LatexCommand \label{sec:ConfRef} + \end_inset - - -\begin_inset Text +Configuration directive reference \layout Standard -request_line +It is imperative that you understand which directives are used +\emph on +only once +\emph default +in the main server config, and which are used inside VirtualHost stanzas + and therefore multiple times within httpd.conf. + The +\begin_inset Quotes eld \end_inset - - -\begin_inset Text - -\layout Standard -varchar(255) +context +\begin_inset Quotes srd \end_inset - - -\begin_inset Text -\layout Standard + listed with each entry informs you of this. +\layout Subsubsection -GET /books-cycroad.html HTTP/1.1 -\end_inset - - - - -\begin_inset Text +LogSQLDatabase +\layout LyX-Code -\layout Standard -S -\end_inset - - -\begin_inset Text +\series bold +MANDATORY +\layout LyX-Code -\layout Standard +Syntax: LogSQLDatabase database +\layout LyX-Code -Time of request in UNIX format -\end_inset - - -\begin_inset Text +Example: LogSQLDatabase loggingdb +\layout LyX-Code -\layout Standard +Context: main server config +\layout Quote -time_stamp -\end_inset - - -\begin_inset Text +Defines the database that is used for logging. + database must be operating on the MySQL host defined in LogSQLLoginInfo. + This is defined only once in the httpd.conf file. +\layout Subsubsection -\layout Standard +LogSQLLoginInfo +\layout LyX-Code -int unsigned -\end_inset - - -\begin_inset Text -\layout Standard +\series bold +MANDATORY +\series default + +\layout LyX-Code -1005598029 -\end_inset - - - - -\begin_inset Text +Syntax: LogSQLLoginInfo host user password +\layout LyX-Code -\layout Standard +Example: LogSQLLoginInfo foobar.baz.com logwriter passw0rd +\layout LyX-Code + +Context: main server config +\layout Quote + +Defines the general parameters of the MySQL host to which you will be logging. + host is the hostname or IP address of the MySQL machine. + user is the MySQL userid (not a Unix userid!) with INSERT privileges on + the table defined in LogSQLTransferLogTable. + password is that user's password. + This is defined only once in the httpd.conf file. +\layout Subsubsection + +LogSQLTCPPort +\layout LyX-Code + +Syntax: LogSQLTCPPort portnumber +\layout LyX-Code + +Example: LogSQLTCPPort 3309 +\layout LyX-Code + +Default: 3306 +\layout LyX-Code + +Context: main server config +\layout Quote + +Your database may listen on a different port than the default. + If so, use this directive to instruct the module which port to use. + This directive only applies if the database is on a different machine connected + via TCP/IP. +\layout Subsubsection + +LogSQLSocketFile +\layout LyX-Code + +Syntax: LogSQLSocketFile filename +\layout LyX-Code + +Example: LogSQLSocketFile /tmp/mysql.sock +\layout LyX-Code + +Default: /var/lib/mysql/mysql.sock +\layout LyX-Code + +Context: main server config +\layout Quote + +At Apache runtime you can specify the MySQL socket file to use. + Set this once in your main server config to override the default value. + This value is irrelevant if your database resides on a separate machine. +\layout Quote + +mod_log_sql will automatically employ the socket for db communications if + the database resides on the local host. + If the db resides on a separate host the module will automatically use + TCP/IP. + This is a function of the MySQL API and is not user-configurable. +\layout Subsubsection + +LogSQLPreserveFile +\layout LyX-Code + +Syntax: LogSQLPreserveFile filename +\layout LyX-Code + +Example: LogSQLPreserveFile offline-preserve +\layout LyX-Code + +Default: /tmp/sql-preserve +\layout LyX-Code + +Context: virtual host +\layout Quote + +mod_log_sql writes queries to this local preserve file in the event that + it cannot reach the database, and thus ensures that your high-availability + web frontend does not lose logs during a temporary database outage. + This could happen for a number of reasons: the database goes offline, the + network breaks, etc. + You will not lose entries since the module has this backup. + The file consists of a series of SQL statements that can be imported into + your database at your convenience; furthermore, because the SQL queries + contain the access timestamps you do not need to worry about out-of-order + data after the import. +\layout Quote + +If you do not define LogSQLPreserveFile then all virtual servers will log + to the same default preserve file (/tmp/mysql-preserve). + You can redefine this on a virtual-host basis in order to segregate your + preserve files if you desire. + Note that segregation is not really necessary, as the SQL statements that + are written to the preserve file already distinguish between different + virtual hosts if you include the 'v' character in your LogSQLTransferLogFormat + directive. +\layout Quote + +The module will log to error-log if/when it notices a database outage, and + upon database return. + You will therefore know when the preserve file is being used, although + it is your responsibility to import the file. +\layout Quote + +The file does not need to be created in advance. + It is safe to remove or rename the file without interrupting Apache, as + the module closes the filehandle immediately after completing the write. + The file is created with the user & group ID of the running Apache process + (e.g. + 'nobody' on many Linux distributions). +\layout Subsubsection + +LogSQLForcePreserve +\layout LyX-Code + +Syntax: LogSQLForcePreserve Flag +\layout LyX-Code + +Example: LogSQLPreserveFile on +\layout LyX-Code + +Default: off +\layout LyX-Code + +Context: main server config +\layout Quote + +You may need to perform debugging on your database and specifically want + mod_log_sql to make no attempts to log to it. + This directive instructs the module to send all its log entries directly + to the preserve file and to make no database INSERT attempts. +\layout Quote + +This is presumably a directive for temporary use only; it could be dangerous + if you set it and forget it, as all your entries will simply pile up in + the preserve file. +\layout Subsubsection + +LogSQLMachineID +\layout LyX-Code + +Syntax: LogSQLMachineID somename +\layout LyX-Code + +Example: LogSQLMachineID web01 +\layout LyX-Code + +Context: main server config +\layout Quote + +If you have a farm of webservers you may wish to log which particular machine + made each entry; this is useful for analyzing your loadbalancing methodology. + LogSQLMachineID permits you to distinguish each machine's entries if you + assign each machine its own LogSQLMachineID: for example, web01, web02, + web03, etc. +\layout Subsubsection + +LogSQLCreateTables +\layout LyX-Code + +Syntax: LogSQLCreateTables flag +\layout LyX-Code + +Example: LogSQLCreateTables On +\layout LyX-Code + +Default: Off +\layout LyX-Code + +Context: main server config +\layout Quote + +mod_log_sql has the ability to create its tables on-the-fly. + The advantage to this is convenience: you don't have to execute any SQL + by hand to prepare the table. + This is especially helpful for people with lots of virtual hosts (who should + also see the LogSQLMassVirtualHosting directive). +\layout Quote + +There is a slight disadvantage: if you wish to activate this feature, then + the user specified by LogSQLLoginInfo must have CREATE privileges on the + database. + In an absolutely paranoid, locked-down situation you may only want to grant + your mod_log_sql user INSERT privileges on the database; in that situation + you are unable to take advantage of LogSQLCreateTables. + But most people -- even the very security-conscious -- will find that granting + CREATE on the logging database is reasonable. +\layout Quote + +Defined this only once in the httpd.conf file. +\layout Subsubsection + +LogSQLMassVirtualHosting +\layout LyX-Code + +Syntax: LogSQLMassVirtualHosting flag +\layout LyX-Code + +Example: LogSQLMassVirtualHosting On +\layout LyX-Code + +Default: Off +\layout LyX-Code + +Context: main server config +\layout Quote + +If you administer a site hosting many, many virtual hosts then this option + will appeal to you. + If you activate LogSQLMassVirtualHosting then several things happen: +\begin_deeper +\layout Itemize + +the on-the-fly table creation feature is activated automatically +\layout Itemize + +the transfer log table name is dynamically set from the virtual host's name + (example: a virtual host www.grubbybaby.com gets logged to table access_www_grubb +ybaby_com) +\layout Itemize + +which, in turn, means that each virtual host logs to its own segregated + table. + Because there is no data shared between virtual servers you can grant your + users access to the tables they need; they will be unable to view others' + data. +\end_deeper +\layout Quote + +This is a huge boost in convenience for sites with many virtual servers. + Activating LogSQLMassVirtualHosting obviates the need to create every virtual + server's table and provides more granular security possibilities. +\layout Quote + +This is defined only once in the httpd.conf file. +\layout Subsubsection + +LogSQLTransferLogTable +\layout LyX-Code + + +\series bold +MANDATORY (if not LogSQLMassVirtualHosting) +\layout LyX-Code + +Syntax: LogSQLTransferLogTable table-name +\layout LyX-Code + +Example: LogSQLTransferLogTable access_log_table +\layout LyX-Code + +Context: virtual host +\layout Quote + +Defines which table is used for logging of Apache's transfers; this is analogous + to Apache's TransferLog directive. + table-name must be a valid table within the database defined in LogSQLDatabase. +\layout Quote + +This directive is not necessary if you declare LogSQLMassVirtualHosting + On, since that directive activates dynamically-named tables. + If you attempt to use LogSQLTransferLogTable at the same time a warning + will be logged and it will be ignored, since LogSQLMassVirtualHosting takes + priority. +\layout Subsubsection + +LogSQLRequestIgnore +\layout LyX-Code + +Syntax: LogSQLRequestIgnore req1 req2 req3 ... + reqN +\layout LyX-Code + +Example: LogSQLRequestIgnore root.exe cmd.exe default.ida favicon.ico +\layout LyX-Code + +Context: virtual host +\layout Quote + +Lists a series of strings that, if present in the URI, will cause that request + NOT to be logged. + This directive is useful for cutting down on log clutter when you KNOW + that you do not want to log requests for certain objects. + (The example above is a genuinely useful one; it will prevent logging of + many common Microsoft-based worm intrusion attempts, as well as those ridiculou +s requests for the favicon.) +\layout Quote + +Each string is separated by a space, and NO regular expressions or globbing + are allowed. + Each string is evaluated as a substring of the URI using strstr(). +\layout Subsubsection + +LogSQLRemhostIgnore +\layout LyX-Code + +Syntax: LogSQLRemhostIgnore host1 host2 host3 ... + hostN +\layout LyX-Code + +Example: LogSQLRemhostIgnore localnet.com +\layout LyX-Code + +Context: virtual host +\layout Quote + +Lists a series of strings that, if present in the REMOTE_HOST, will cause + that request NOT to be logged. + This directive is useful for cutting down on log clutter when you KNOW + that you do not want to log requests from certain hosts, such as your own + internal network machines. +\layout Quote + +Each string is separated by a space, and NO regular expressions or globbing + are allowed. + Each string is simply evaluated as a substring of the REMOTE_HOST using + strstr(). +\layout Subsubsection + +LogSQLTransferLogFormat +\layout LyX-Code + +Syntax: LogSQLTransferLogFormat format-string +\layout LyX-Code + +Example: LogSQLTransferLogFormat huSUTv +\layout LyX-Code + +Default: AbHhmRSsTUuv +\layout LyX-Code + +Context: virtual host +\layout Quote + +Each character in the format-string defines an attribute of the request + that you wish to log. + The default logs the information required to create Combined Log Format + logs, plus several extras. + Here is the full list of allowable keys, which sometimes resemble their + Apache counterparts, but do not always: +\layout Quote + + +\begin_inset Tabular + + + + + + + + + +\begin_inset Text + +\layout Standard + + +\series bold +Char +\end_inset + + +\begin_inset Text + +\layout Standard + + +\series bold +What is this? +\end_inset + + +\begin_inset Text + +\layout Standard + + +\series bold +MySQL DB field +\end_inset + + +\begin_inset Text + +\layout Standard + + +\series bold +Column type +\end_inset + + +\begin_inset Text + +\layout Standard + + +\series bold +Example +\end_inset + + + + +\begin_inset Text + +\layout Standard + +A +\end_inset + + +\begin_inset Text + +\layout Standard + +User agent +\end_inset + + +\begin_inset Text + +\layout Standard + +agent +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(255) +\end_inset + + +\begin_inset Text + +\layout Standard + +Mozilla/4.0 (compat; MSIE 6.0; Windows) +\end_inset + + + + +\begin_inset Text + +\layout Standard + +b +\end_inset + + +\begin_inset Text + +\layout Standard + +Bytes transfered +\end_inset + + +\begin_inset Text + +\layout Standard + +bytes_sent +\end_inset + + +\begin_inset Text + +\layout Standard + +int unsigned +\end_inset + + +\begin_inset Text + +\layout Standard + +32561 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +c +\end_inset + + +\begin_inset Text + +\layout Standard + +Text of cookie +\end_inset + + +\begin_inset Text + +\layout Standard + +cookie +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(255) +\end_inset + + +\begin_inset Text + +\layout Standard + +Apache=sdyn.fooonline.net.1300102700823 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +H +\end_inset + + +\begin_inset Text + +\layout Standard + +HTTP request protocol +\end_inset + + +\begin_inset Text + +\layout Standard + +request_protocol +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(10) +\end_inset + + +\begin_inset Text + +\layout Standard + +HTTP/1.1 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +h +\end_inset + + +\begin_inset Text + +\layout Standard + +Name of remote host +\end_inset + + +\begin_inset Text + +\layout Standard + +remote_host +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(50) +\end_inset + + +\begin_inset Text + +\layout Standard + +blah.foobar.com +\end_inset + + + + +\begin_inset Text + +\layout Standard + +I +\end_inset + + +\begin_inset Text + +\layout Standard + +Request ID (from mod_unique_id) +\end_inset + + +\begin_inset Text + +\layout Standard + +id +\end_inset + + +\begin_inset Text + +\layout Standard + +char(19) +\end_inset + + +\begin_inset Text + +\layout Standard + +POlFcUBRH30AAALdBG8 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +l +\end_inset + + +\begin_inset Text + +\layout Standard + +Ident user info +\end_inset + + +\begin_inset Text + +\layout Standard + +remote_logname +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(50) +\end_inset + + +\begin_inset Text + +\layout Standard + +bobby +\end_inset + + + + +\begin_inset Text + +\layout Standard + +m +\end_inset + + +\begin_inset Text + +\layout Standard + +HTTP request method +\end_inset + + +\begin_inset Text + +\layout Standard + +request_method +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(6) +\end_inset + + +\begin_inset Text + +\layout Standard + +GET +\end_inset + + + + +\begin_inset Text + +\layout Standard + +P +\end_inset + + +\begin_inset Text + +\layout Standard + +httpd child PID +\end_inset + + +\begin_inset Text + +\layout Standard + +child_pid +\end_inset + + +\begin_inset Text + +\layout Standard + +smallint unsigned +\end_inset + + +\begin_inset Text + +\layout Standard + +3215 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +p +\end_inset + + +\begin_inset Text + +\layout Standard + +httpd port +\end_inset + + +\begin_inset Text + +\layout Standard + +server_port +\end_inset + + +\begin_inset Text + +\layout Standard + +smallint unsigned +\end_inset + + +\begin_inset Text + +\layout Standard + +80 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +R +\end_inset + + +\begin_inset Text + +\layout Standard + +Referer +\end_inset + + +\begin_inset Text + +\layout Standard + +referer +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(255) +\end_inset + + +\begin_inset Text + +\layout Standard + +http://www.biglinks4u.com/linkpage.html +\end_inset + + + + +\begin_inset Text + +\layout Standard + +r +\end_inset + + +\begin_inset Text + +\layout Standard + +Request in full form +\end_inset + + +\begin_inset Text + +\layout Standard + +request_line +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(255) +\end_inset + + +\begin_inset Text + +\layout Standard + +GET /books-cycroad.html HTTP/1.1 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +S +\end_inset + + +\begin_inset Text + +\layout Standard + +Time of request in UNIX format +\end_inset + + +\begin_inset Text + +\layout Standard + +time_stamp +\end_inset + + +\begin_inset Text + +\layout Standard + +int unsigned +\end_inset + + +\begin_inset Text + +\layout Standard + +1005598029 +\end_inset + + + + +\begin_inset Text + +\layout Standard s \end_inset @@ -1807,43 +2562,715 @@ s \begin_inset Text -\layout Standard +\layout Standard + +HTTP status of request +\end_inset + + +\begin_inset Text + +\layout Standard + +status +\end_inset + + +\begin_inset Text + +\layout Standard + +smallint unsigned +\end_inset + + +\begin_inset Text + +\layout Standard + +404 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +T +\end_inset + + +\begin_inset Text + +\layout Standard + +Seconds to service request +\end_inset + + +\begin_inset Text + +\layout Standard + +request_duration +\end_inset + + +\begin_inset Text + +\layout Standard + +smallint unsigned +\end_inset + + +\begin_inset Text + +\layout Standard + +2 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +t +\end_inset + + +\begin_inset Text + +\layout Standard + +Time of request in human format +\end_inset + + +\begin_inset Text + +\layout Standard + +request_time +\end_inset + + +\begin_inset Text + +\layout Standard + +char(28) +\end_inset + + +\begin_inset Text + +\layout Standard + +[02/Dec/2001:15:01:26 -0800] +\end_inset + + + + +\begin_inset Text + +\layout Standard + +U +\end_inset + + +\begin_inset Text + +\layout Standard + +Request in simple form +\end_inset + + +\begin_inset Text + +\layout Standard + +request_uri +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(255) +\end_inset + + +\begin_inset Text + +\layout Standard + +/books-cycroad.html +\end_inset + + + + +\begin_inset Text + +\layout Standard + +u +\end_inset + + +\begin_inset Text + +\layout Standard + +User info from HTTP authentication +\end_inset + + +\begin_inset Text + +\layout Standard + +remote_user +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(50) +\end_inset + + +\begin_inset Text + +\layout Standard + +bobby +\end_inset + + + + +\begin_inset Text + +\layout Standard + +v +\end_inset + + +\begin_inset Text + +\layout Standard + +Virtual host servicing the request +\end_inset + + +\begin_inset Text + +\layout Standard + +virtual_host +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(50) +\end_inset + + +\begin_inset Text + +\layout Standard + +www.foobar.com +\end_inset + + + + +\end_inset + + +\layout Quote + +If you have compiled mod_log_sql with WANT_SSL_LOGGING, you also get these: +\layout Quote + + +\begin_inset Tabular + + + + + + + + + +\begin_inset Text + +\layout Standard + + +\series bold +Char +\end_inset + + +\begin_inset Text + +\layout Standard + + +\series bold +What is this? +\end_inset + + +\begin_inset Text + +\layout Standard + + +\series bold +MySQL DB field +\end_inset + + +\begin_inset Text + +\layout Standard + + +\series bold +Column Type +\end_inset + + +\begin_inset Text + +\layout Standard + + +\series bold +Example +\end_inset + + + + +\begin_inset Text + +\layout Standard + +z +\end_inset + + +\begin_inset Text + +\layout Standard + +SSL cipher used +\end_inset + + +\begin_inset Text + +\layout Standard + +ssl_cipher +\end_inset + + +\begin_inset Text + +\layout Standard + +varchar(25) +\end_inset + + +\begin_inset Text + +\layout Standard + +RC4-MD5 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +q +\end_inset + + +\begin_inset Text + +\layout Standard + +Keysize of the SSL connection +\end_inset + + +\begin_inset Text + +\layout Standard + +ssl_keysize +\end_inset + + +\begin_inset Text + +\layout Standard + +smallint unsigned +\end_inset + + +\begin_inset Text + +\layout Standard + +56 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +Q +\end_inset + + +\begin_inset Text + +\layout Standard + +Maximum keysize supported +\end_inset + + +\begin_inset Text + +\layout Standard + +ssl_maxkeysize +\end_inset + + +\begin_inset Text + +\layout Standard + +smallint unsigned +\end_inset + + +\begin_inset Text + +\layout Standard + +128 +\end_inset + + + + +\end_inset + + +\layout Subsubsection + +LogSQLWhichCookie +\layout LyX-Code + +Syntax: LogSQLWhichCookie cookiename +\layout LyX-Code + +Example: LogSQLWhichCookie Clicks +\layout LyX-Code + +Default: None. + You must set this if you wish to capture cookies. +\layout LyX-Code + +Context: virtual host +\layout Quote -HTTP status of request -\end_inset - - -\begin_inset Text +In HTTP, cookies have names to distinguish them from each other. + Using mod_usertrack, for example, you can give your user-tracking cookies + a name with the CookieName directive. +\layout Quote + +If you have activated cookie logging in LogSQLTransferLogFormat, then LogSQLWhic +hCookie tells mod_log_sql which cookie to log. + This is useful because many times you will be setting and receiving more + than one cookie from a client; without this directive you'd be unable to + choose which cookie is your mod_usertrack cookie. +\layout Quote + +Note: although this was intended for people who are using mod_usertrack + to set user-tracking cookies, you aren't restricted in any way. + You can choose which cookie you wish to log to the database, and it doesn't + necessarily have to have anything to do with mod_usertrack. +\layout Subsubsection + +LogSQLWhichCookies +\layout LyX-Code + +Syntax: LogSQLWhichCookies cookie1 cookie2 ... + cookieN +\layout LyX-Code + +Example: LogSQLWhichCookies userlogin foobar foobaz +\layout LyX-Code + +Default: None +\layout LyX-Code + +Context: virtual host +\layout Quote + +Defines the list of cookies you would like logged. + Works in conjunction with LogSQLCookieLogTable. +\layout Subsubsection + +LogSQLWhichHeadersIn +\layout LyX-Code + +Syntax: LogSQLWhichHeadersIn item1 item2 ... + itemN +\layout LyX-Code + +Example: LogSQLWhichHeadersIn UserAgent Accept-Encoding Host +\layout LyX-Code + +Default: None +\layout LyX-Code + +Context: virtual host +\layout Quote + +Defines the list of inbound headers you would like logged. + Works in conjunction with LogSQLHeadersInLogTable. +\layout Subsubsection + +LogSQLWhichHeadersOut +\layout LyX-Code + +Syntax: LogSQLWhichHeadersOut item1 item2 ... + itemN +\layout LyX-Code + +Example: LogSQLWhichHeadersOut Expires Content-Type Cache-Control +\layout LyX-Code + +Default: None +\layout LyX-Code + +Context: virtual host +\layout Quote + +Defines the list of outbound headers you would like logged. + Works in conjunction with LogSQLHeadersOutLogTable. +\layout Subsubsection + +LogSQLWhichNotes +\layout LyX-Code + +Syntax: LogSQLWhichNotes item1 item2 ... + itemN +\layout LyX-Code + +Example: LogSQLWhichNotes mod_gzip_result mod_gzip_compression_ratio +\layout LyX-Code + +Default: None +\layout LyX-Code + +Context: virtual host +\layout Quote + +Defines the list of notes you would like logged. + Works in conjunction with LogSQLNotesLogTable. +\layout Subsubsection + +LogSQLCookieLogTable +\layout LyX-Code + +Syntax: LogSQLCookieLogTable table-name +\layout LyX-Code + +Example: LogSQLCookieLogTable cookie_log +\layout LyX-Code + +Default: cookies +\layout LyX-Code + +Context: virtual host +\layout Quote + +Defines which table is used for logging of cookies. + Working in conjunction with LogSQLWhichCookies, you can log many of each + request's associated cookies to a separate table. + For meaningful data retrieval the cookie table is keyed to the access table + by the unique request ID supplied by the standard Apache module mod_unique_id. +\layout Subsubsection + +LogSQLHeadersInLogTable +\layout LyX-Code + +Syntax: LogSQLHeadersInLogTable table-name +\layout LyX-Code + +Example: LogSQLHeadersInLogTable headers +\layout LyX-Code + +Default: headers_in +\layout LyX-Code + +Context: virtual host +\layout Quote + +Defines which table is used for logging of inbound headers. + Working in conjunction with LogSQLWhichHeadersIn, you can log many of each + request's associated headers to a separate table. + For meaningful data retrieval the headers table is keyed to the access + table by the unique request ID supplied by the standard Apache module mod_uniqu +e_id. +\layout Subsubsection + +LogSQLHeadersOutLogTable +\layout LyX-Code + +Syntax: LogSQLHeadersOutLogTable table-name +\layout LyX-Code + +Example: LogSQLHeadersOutLogTable headers +\layout LyX-Code + +Default: headers_out +\layout LyX-Code + +Context: virtual host +\layout Quote + +Defines which table is used for logging of outbound headers. + Working in conjunction with LogSQLWhichHeadersOut, you can log many of + each request's associated headers to a separate table. + For meaningful data retrieval the headers table is keyed to the access + table by the unique request ID supplied by the standard Apache module mod_uniqu +e_id. +\layout Subsubsection + +LogSQLNotesLogTable +\layout LyX-Code + +Syntax: LogSQLNotesLogTable table-name +\layout LyX-Code + +Example: LogSQLNotesLogTable notes_log +\layout LyX-Code + +Default: notes +\layout LyX-Code + +Context: virtual host +\layout Quote + +Defines which table is used for logging of notes. + Working in conjunction with LogSQLWhichNotes, you can log many of each + request's associated notes to a separate table. + For meaningful data retrieval the notes table is keyed to the access table + by the unique request ID supplied by the standard Apache module mod_unique_id. +\layout Section +FAQ +\layout Subsection + +Why log to an SQL database? \layout Standard -status +To begin with, let's get it out of the way: logging to a database is not + a panacea. + But while there are complexities with this solution, the benefit can be + substantial for certain classes of administrator or people with advanced + requirements: +\layout Itemize + +Chores like log rotation go away, as you can DELETE records from the SQL + database once they are no longer useful. + For example, the excellent and popular log-analysis tool +\begin_inset LatexCommand \url[Webalizer]{http://www.webalizer.com} + \end_inset - - -\begin_inset Text + does not need historic logs after it has processed them, enabling you to + delete older logs. + +\layout Itemize + +People with clusters of web servers (for high availability) will benefit + the most -- all their webservers can log to a single SQL database. + This obviates the need to collate/interleave the many separate logfiles, + which can be / highly/ problematic. + +\layout Itemize + +People acquainted with the power of SQL SELECT statements will know the + flexibility of the extraction possibilities at their fingertips. \layout Standard -smallint unsigned -\end_inset - - -\begin_inset Text +For example, do you want to see all your 404's? Do this: +\layout LyX-Code + +select remote_host,status,request_uri,bytes_sent,from_unixtime(time_stamp) + from acc_log_tbl where status=404 order by time_stamp; +\layout LyX-Code \layout Standard +\align center -404 -\end_inset - - - +\begin_inset Tabular + + + + + + + + \begin_inset Text \layout Standard -T +remote_host \end_inset @@ -1851,7 +3278,7 @@ T \layout Standard -Seconds to service request +status \end_inset @@ -1859,7 +3286,7 @@ Seconds to service request \layout Standard -request_duration +request_uri \end_inset @@ -1867,15 +3294,15 @@ request_duration \layout Standard -smallint unsigned +bytes_sent \end_inset - + \begin_inset Text \layout Standard -2 +from_unixtime(time_stamp) \end_inset @@ -1885,7 +3312,7 @@ smallint unsigned \layout Standard -t +marge.mmm.co.uk \end_inset @@ -1893,7 +3320,7 @@ t \layout Standard -Time of request in human format +404 \end_inset @@ -1901,7 +3328,7 @@ Time of request in human format \layout Standard -request_time +/favicon.ico \end_inset @@ -1909,15 +3336,15 @@ request_time \layout Standard -char(28) +321 \end_inset - + \begin_inset Text \layout Standard -[02/Dec/2001:15:01:26 -0800] +2001-11-20 02:30:56 \end_inset @@ -1927,7 +3354,7 @@ char(28) \layout Standard -U +62.180.239.251 \end_inset @@ -1935,7 +3362,7 @@ U \layout Standard -Request in simple form +404 \end_inset @@ -1943,7 +3370,7 @@ Request in simple form \layout Standard -request_uri +/favicon.ico \end_inset @@ -1951,15 +3378,15 @@ request_uri \layout Standard -varchar(255) +333 \end_inset - + \begin_inset Text \layout Standard -/books-cycroad.html +2001-11-20 02:45:25 \end_inset @@ -1969,7 +3396,7 @@ varchar(255) \layout Standard -u +212.234.12.66 \end_inset @@ -1977,7 +3404,7 @@ u \layout Standard -User info from HTTP authentication +404 \end_inset @@ -1985,7 +3412,7 @@ User info from HTTP authentication \layout Standard -remote_user +/favicon.ico \end_inset @@ -1993,15 +3420,15 @@ remote_user \layout Standard -varchar(50) +321 \end_inset - + \begin_inset Text \layout Standard -bobby +2001-11-20 03:01:00 \end_inset @@ -2011,7 +3438,7 @@ bobby \layout Standard -v +212.210.78.254 \end_inset @@ -2019,7 +3446,7 @@ v \layout Standard -Virtual host servicing the request +404 \end_inset @@ -2027,7 +3454,7 @@ Virtual host servicing the request \layout Standard -virtual_host +/favicon.ico \end_inset @@ -2035,15 +3462,15 @@ virtual_host \layout Standard -varchar(50) +333 \end_inset - + \begin_inset Text \layout Standard -www.foobar.com +2001-11-20 03:26:05 \end_inset @@ -2052,38 +3479,35 @@ www.foobar.com \end_inset -\layout Quote - -If you have compiled mod_log_sql with WANT_SSL_LOGGING, you also get these: -\layout Quote - - -\begin_inset Tabular - - - - - - - - -\begin_inset Text +\layout LyX-Code \layout Standard +Or do you want to see how many bytes you've sent within a certain directory + or site? Do this: +\layout LyX-Code + +select request_uri,sum(bytes_sent) as bytes,count(request_uri) as howmany + from acc_log_tbl where request_uri like '%mod_log_sql%' group by request_uri + order by howmany desc; +\layout LyX-Code -\series bold -Character -\end_inset - +\layout Standard +\align center + +\begin_inset Tabular + + + + + + \begin_inset Text \layout Standard - -\series bold -MySQL DB field it activates +request_uri \end_inset @@ -2091,9 +3515,7 @@ MySQL DB field it activates \layout Standard - -\series bold -MySQL DB field it activatesRecommended column type +bytes \end_inset @@ -2101,9 +3523,7 @@ MySQL DB field it activatesRecommended column type \layout Standard - -\series bold -Example +howmany \end_inset @@ -2113,7 +3533,7 @@ Example \layout Standard -z +/mod_log_sql/style_1.css \end_inset @@ -2121,75 +3541,77 @@ z \layout Standard -ssl_cipher +157396 \end_inset - + \begin_inset Text \layout Standard -varchar(25) +1288 \end_inset - + + + \begin_inset Text \layout Standard -RC4-MD5 +/mod_log_sql/ \end_inset - - \begin_inset Text \layout Standard -q +2514337 \end_inset - + \begin_inset Text \layout Standard -ssl_keysize +801 \end_inset + + \begin_inset Text \layout Standard -smallint unsigned +/mod_log_sql/mod_log_sql.tar.gz \end_inset - + \begin_inset Text \layout Standard -56 +9769312 \end_inset - - - + \begin_inset Text \layout Standard -Q +456 \end_inset + + \begin_inset Text \layout Standard -ssl_maxkeysize +/mod_log_sql/faq.html \end_inset @@ -2197,7 +3619,7 @@ ssl_maxkeysize \layout Standard -smallint unsigned +5038728 \end_inset @@ -2205,7 +3627,7 @@ smallint unsigned \layout Standard -128 +436 \end_inset @@ -2214,175 +3636,122 @@ smallint unsigned \end_inset -\layout Section - -FAQ -\layout Subsection - -Why log to an SQL database? -\layout Standard - -To begin with, let's get it out of the way: logging to a database is not - a panacea. - But while there are complexities with this solution, the benefit can be - substantial for certain classes of administrator or people with advanced - requirements: -\layout Itemize - -Chores like log rotation go away, as you can DELETE records from the SQL - database once they are no longer useful. - For example, the excellent and popular log-analysis tool Webalizer (http://www.w -ebalizer.com/) does not need historic logs after it has processed them, enabling - you to delete older logs. - -\layout Itemize - -People with clusters of web servers (for high availability) will benefit - the most -- all their webservers can log to a single SQL database. - This obviates the need to collate/interleave the many separate logfiles, - which can be / highly/ problematic. - -\layout Itemize - -People acquainted with the power of SQL SELECT statements will know the - flexibility of the extraction possibilities at their fingertips. -\layout Standard - -For example, do you want to see all your 404's? Do this: -\layout LyX-Code - -select remote_host,status,request_uri,bytes_sent,from_unixtime(time_stamp) - from acc_log_tbl where status=404 order by time_stamp; -\layout LyX-Code - -+-----------------------------------+--------+--------------------------+------- ------+--------------------------- -\layout LyX-Code - -+ remote_host | status | request_uri - | bytes_sent | from_unixtime(time_stamp)| \layout LyX-Code -+-----------------------------------+--------+--------------------------+------- ------+--------------------------- -\layout LyX-Code +\layout Standard -| marge.mmm.co.uk | 404 | /favicon.ico | 321 - | 2001-11-20 02:30:56 | +Or maybe you want to see who's linking to you? Do this: \layout LyX-Code -| 62.180.239.251 | 404 | /favicon.ico | 333 - | 2001-11-20 02:45:25 | +select count(referer) as num,referer from acc_log_tbl where request_uri='/mod_lo +g_sql/' group by referer order by num desc; \layout LyX-Code -| 212.234.12.66 | 404 | /favicon.ico | 321 - | 2001-11-20 03:01:00 | \layout LyX-Code +\align center -| 212.210.78.254 | 404 | /favicon.ico | 333 - | 2001-11-20 03:26:05 | -\layout LyX-Code +\begin_inset Tabular + + + + + + +\begin_inset Text -+-----------------------------------+--------+--------------------------+------- ------+---------------------------+ \layout Standard -Or do you want to see how many bytes you've sent within a certain directory - or site? Do this: -\layout LyX-Code - -select request_uri,sum(bytes_sent) as bytes,count(request_uri) as howmany - from acc_log_tbl where request_uri like '%mod_log_sql%' group by request_uri - order by howmany desc; -\layout LyX-Code - -+-----------------------------------+---------+---------+ -\layout LyX-Code - -| request_uri | bytes | howmany | -\layout LyX-Code - -+-----------------------------------+---------+---------+ -\layout LyX-Code +num +\end_inset + + +\begin_inset Text -| /mod_log_sql/style_1.css | 157396 | 1288 | -\layout LyX-Code +\layout Standard -| /mod_log_sql/ | 2514337 | 801 | -\layout LyX-Code +referer +\end_inset + + + + +\begin_inset Text -| /mod_log_sql/mod_log_sql.tar.gz | 9769312 | 456 | -\layout LyX-Code +\layout Standard -| /mod_log_sql/faq.html | 5038728 | 436 | -\layout LyX-Code +271 +\end_inset + + +\begin_inset Text -| /mod_log_sql/INSTALL | 1196161 | 202 | -\layout LyX-Code +\layout Standard -| /mod_log_sql/directives.html | 1096821 | 171 | -\layout LyX-Code +http://freshmeat.net/projects/mod_log_sql/ +\end_inset + + + + +\begin_inset Text -| /mod_log_sql/CHANGELOG | 424481 | 107 | -\layout LyX-Code +\layout Standard -| /mod_log_sql/README | 796072 | 97 | -\layout LyX-Code +96 +\end_inset + + +\begin_inset Text -| /mod_log_sql/directives-old.html | 42480 | 6 | -\layout LyX-Code +\layout Standard -| /mod_log_sql/index.html | 9531 | 3 | -\layout LyX-Code +http://modules.apache.org/search?id=339 +\end_inset + + + + +\begin_inset Text -+-----------------------------------+---------+---------+ \layout Standard -Or maybe you want to see who's linking to you? Do this: -\layout LyX-Code - -select count(referer) as num,referer from acc_log_tbl where request_uri='/mod_lo -g_sql/' group by referer order by num desc; -\layout LyX-Code +48 +\end_inset + + +\begin_inset Text -+-----+------------------------------------------------------------------------- -------+ -\layout LyX-Code +\layout Standard -| num | referer - | -\layout LyX-Code +http://freshmeat.net/ +\end_inset + + + + +\begin_inset Text -+-----+------------------------------------------------------------------------- -------+ -\layout LyX-Code +\layout Standard -| 271 | http://freshmeat.net/projects/mod_log_sql/ - | -\layout LyX-Code +8 +\end_inset + + +\begin_inset Text -| 96 | http://modules.apache.org/search?id=339 - | -\layout LyX-Code +\layout Standard -| 48 | http://freshmeat.net/ - | -\layout LyX-Code +http://freshmeat.net +\end_inset + + + -| 8 | http://freshmeat.net - | -\layout LyX-Code +\end_inset -| 7 | http://freshmeat.net/daily/2001/11/30/ - | -\layout LyX-Code -| 6 | http://freshmeat.net/daily/2001/11/20/ - | \layout LyX-Code -+-----+------------------------------------------------------------------------- -------+ \layout Standard As you can see, there are myriad possibilities that can be constructed with @@ -2444,12 +3813,9 @@ Machine B: MySQL server \layout Itemize Machines A and B connected with 100Mbps Ethernet -\layout Standard - -Webserver configuration: \layout Itemize -Celeron 400 128 MB RAM IDE storage +Webserver: Celeron 400, 128 MB RAM, IDE storage \layout Standard Apache configuration: @@ -2515,23 +3881,31 @@ Average of five runs employing MySQL \emph on and \emph default - standard text logging: 139.01 requests per second, zero errors. + standard text logging: +\series bold +139.01 requests per second, zero errors +\series default +. \layout Itemize Average of five runs employing \emph on only \emph default - standard text logging: 139.96 requests per second, zero errors. + standard text logging: +\series bold +139.96 requests per second, zero errors +\series default +. \layout Standard In other words, any rate-limiting effects on this particular hardware setup are not caused by MySQL. Note that although this very simple webserver setup is hardly cutting-edge -- it is, after all, a fairly small machine -- 139 requests per second - equal over twelve million hits per day + equal over \emph on -. +twelve million hits per day. \layout Standard If you run this benchmark yourself, take note of three things: @@ -2586,7 +3960,7 @@ mod_log_sql would be virtually useless if there weren't a way for you to For example, let's say that you want your web statistics updated once per day in the wee hours of the morning. - A good way to accomplish that would be the following entries in /etc/crontab: + A good way to accomplish that could be the following entries in /etc/crontab: \layout LyX-Code # Generate the temporary apache logs from the MySQL database (for webalizer) @@ -2606,14 +3980,14 @@ httpd/mysql-grubbybaby Or if you have a newer system that puts files in /etc/cron.daily etc., create a file called -\begin_inset Quotes sld +\begin_inset Quotes eld \end_inset webalizer \begin_inset Quotes srd \end_inset - in the cron.____ subdir of your choice. + in the cron.daily subdirectory. Use the following as the contents of your file, and make sure to chmod 755 it when done. \layout LyX-Code @@ -2706,93 +4080,170 @@ Next configure your server to set usertracking cookies as follows, and make CookieTracking on \layout LyX-Code - CookieStyle Cookie -\layout LyX-Code + CookieStyle Cookie +\layout LyX-Code + + CookieName Foobar +\layout LyX-Code + + LogSQLTransferLogFormat huSUsbTvRAc +\layout LyX-Code + + LogSQLWhichCookie Foobar +\layout LyX-Code + + +\layout Standard + +The first three lines configure mod_usertrack to create a COOKIE (RFC 2109) + format cookie called Foobar. + The last two lines tell mod_log_sql to log cookies named Foobar. + You have to choose which cookie to log because more than one cookie can/will + be sent to the server by the client. +\layout Standard + +FYI, you are advised NOT to use CookieStyle Cookie2 -- it seems that even + newer browsers (IE 5.5, etc.) have trouble with the new COOKIE2 (RFC 2965) + format. + Just stick with the standard COOKIE format and you'll be fine. +\layout Standard + +Perform some hits on your server and run a select: +\layout LyX-Code + +mysql> select request_uri,cookie from access_log where cookie is not null; +\layout LyX-Code + +\layout LyX-Code +\align center + +\begin_inset Tabular + + + + + + +\begin_inset Text + +\layout Standard + +request_uri +\end_inset + + +\begin_inset Text + +\layout Standard - CookieName Foobar -\layout LyX-Code +cookie +\end_inset + + + + +\begin_inset Text - LogSQLTransferLogFormat huSUsbTvRAc -\layout LyX-Code +\layout Standard - LogSQLWhichCookie Foobar -\layout LyX-Code +/mod_log_sql/ +\end_inset + + +\begin_inset Text - \layout Standard -The first three lines configure mod_usertrack to create a COOKIE (RFC 2109) - format cookie called Foobar. - The last two lines tell mod_log_sql to log cookies named Foobar. - You have to choose which cookie to log because more than one cookie can/will - be sent to the server by the client. +ool-18e4.dyn.optonline.net.130051007102700823 +\end_inset + + + + +\begin_inset Text + \layout Standard -FYI, you are advised NOT to use CookieStyle Cookie2 -- it seems that even - newer browsers (IE 5.5, etc.) have trouble with the new COOKIE2 (RFC 2965) - format. - Just stick with the standard COOKIE format and you'll be fine. +/mod_log_sql/usa.gif +\end_inset + + +\begin_inset Text + \layout Standard -Perform some hits on your server and run a select: -\layout LyX-Code +ool-18e4.dyn.optonline.net.130051007102700823 +\end_inset + + + + +\begin_inset Text -mysql> select request_uri,cookie from access_log where cookie is not null; -\layout LyX-Code +\layout Standard -+--------------------------------------------+---------------------------------- -------------------+ -\layout LyX-Code +/mod_log_sql/style_1.css +\end_inset + + +\begin_inset Text -| request_uri | - cookie | -\layout LyX-Code +\layout Standard -+--------------------------------------------+---------------------------------- -------------------+ -\layout LyX-Code +ool-18e4.dyn.optonline.net.130051007102700823 +\end_inset + + + -| /mod_log_sql/ | ool-18e4.dyn.optonline.net.1300510071 -02700823 | -\layout LyX-Code +\end_inset -| /mod_log_sql/usa.gif | ool-18e4.dyn.optonline.net.13005100710 -2700823 | -\layout LyX-Code -| /mod_log_sql/style_1.css | ool-18e4.dyn.optonline.net.13005100710 -2700823 | \layout LyX-Code -...etc... \layout Subsection -What if I want to log more than one cookie? +What if I want to log more than one cookie? What is the difference between + LogSQLWhichCookie and LogSQLWhichCookies? \layout Standard -No problem. - As of version 1.17, you have a choice. - If you are just interested in a single cookie, follow the instructions - in section +As of version 1.17, you have a choice in how you want cookie logging handled. +\layout Standard + +If you are interested in logging only one cookie per request, follow the + instructions in section \begin_inset LatexCommand \ref{sec:cookie} \end_inset above. - That cookie will be logged to a column in the regular access_log table. + That cookie will be logged to a column in the regular access_log table, + and the actual cookie you want to log is specified with LogSQLWhichCookie. + Don't forget to specify the 'c' character in LogSQLTransferLogFormat. \layout Standard -However, if you need to log multiple cookies, you'll employ the LogSQLWhichCooki -es (note the plural) directive. - The cookies you specify will be logged to a separate table, and entries - in that table will be linked to the regular access_log entries via the - unique ID that is supplied by mod_unique_id. +If, however, you need to log multiple cookies per request, you must employ + the LogSQLWhichCookies (note the plural) directive. + The cookies you specify will be logged to a separate table (as discussed + in section +\begin_inset LatexCommand \ref{secMulTable} + +\end_inset + +), and entries in that table will be linked to the regular access_log entries + via the unique ID that is supplied by mod_unique_id. Without mod_unique_id the information will still be logged but you will be unable to correlate which cookies go with which access-requests. + Furthermore, with LogSQLWhichCookies, you do +\series bold +not +\series default + need to include the 'c' character in LogSQLTransferLogFormat. \layout Standard -LogSQLWhichCookie and LogSQLWhichCookies can coexist without conflict, but - you're better off choosing the one you need. +LogSQLWhichCookie and LogSQLWhichCookies can coexist without conflict because + they operate on entireley different tables, but you're better off choosing + the one you need. \layout Subsection What are the SSL logging features, and how do I activate them? @@ -2814,8 +4265,8 @@ You can compile mod_log_sql with SSL logging support if you have the right \layout Standard You need to ensure that your database is set up to log the SSL data. - Issue the following commands to MySQL once you have your basic access_log - table built: + Issue the following commands to MySQL if your access table does not already + have them: \layout LyX-Code alter table access_log add column ssl_cipher varchar(25); @@ -2834,7 +4285,11 @@ Finally configure httpd.conf to activate the SSL fields. \layout LyX-Code - LogSQLTransferLogFormat AbHhmRSsTUuvcQqz + LogSQLTransferLogFormat AbHhmRSsTUuvc +\series bold +Qqz +\series default + \layout LyX-Code @@ -2851,37 +4306,198 @@ mysql> select remote_host,request_uri,ssl_cipher,ssl_keysize,ssl_maxkeysize from access_log where ssl_cipher is not null; \layout LyX-Code -+--------------------------+---------------------------------------------------- -+------------+-------------+----------------+ \layout LyX-Code +\align center -| remote_host | request_uri - | ssl_cipher | ssl_keysize | ssl_maxkeysize | -\layout LyX-Code +\begin_inset Tabular + + + + + + + + + +\begin_inset Text -+--------------------------+---------------------------------------------------- -+------------+-------------+----------------+ -\layout LyX-Code +\layout Standard -| 216.190.52.4 | /dir/somefile.html - | RC4-MD5 | 128 | 128 | -\layout LyX-Code +remote_host +\end_inset + + +\begin_inset Text + +\layout Standard + +request_uri +\end_inset + + +\begin_inset Text + +\layout Standard + +ssl_cipher +\end_inset + + +\begin_inset Text + +\layout Standard + +ssl_keysize +\end_inset + + +\begin_inset Text + +\layout Standard + +ssl_maxkeysize +\end_inset + + + + +\begin_inset Text + +\layout Standard + +216.190.52.4 +\end_inset + + +\begin_inset Text + +\layout Standard + +/dir/somefile.html +\end_inset + + +\begin_inset Text + +\layout Standard + +RC4-MD5 +\end_inset + + +\begin_inset Text + +\layout Standard + +128 +\end_inset + + +\begin_inset Text + +\layout Standard + +128 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +216.190.52.4 +\end_inset + + +\begin_inset Text + +\layout Standard + +/dir/somefile.gif +\end_inset + + +\begin_inset Text + +\layout Standard + +RC4-MD5 +\end_inset + + +\begin_inset Text + +\layout Standard + +128 +\end_inset + + +\begin_inset Text + +\layout Standard + +128 +\end_inset + + + + +\begin_inset Text + +\layout Standard + +216.190.52.4 +\end_inset + + +\begin_inset Text + +\layout Standard + +/dir/somefile.jpg +\end_inset + + +\begin_inset Text + +\layout Standard + +RC4-MD5 +\end_inset + + +\begin_inset Text + +\layout Standard + +128 +\end_inset + + +\begin_inset Text + +\layout Standard + +128 +\end_inset + + + + +\end_inset -| 216.190.52.4 | /dir/somefile.gif - | RC4-MD5 | 128 | 128 | -\layout LyX-Code -| 216.190.52.4 | /dir/somefile.jpg - | RC4-MD5 | 128 | 128 | \layout LyX-Code -...etc... \layout Subsection Does mod_log_sql connect to MySQL via TCP/IP or a socket? \layout Standard -It depends! Actually this isn't determined by mod_log_sql. +It depends! This actually is not determined by mod_log_sql. mod_log_sql relies on a connection command that is supplied in the MySQL API, and that command is somewhat intelligent. When mod_log_sql issues the connect command to MySQL, this intelligent -- cgit