Restart Apache if certain error in log file

[Frank_Rizzo]

I have a problem with segmentation fault(11). Had this with apache 1.3.x and now with 2.0.x. Whilst I try and work out what the fault is I'd like to put a quick fix in place.

What I want to do is to check the log file every 5 mins and if there is evidence of a seg fault then apache should restart.

This should be simple to do. All I have to do is to grep the error.log for 'segmentation fault' and if it exists then run /etc/init.d/apache2 restart

1. How can I use grep to identify that the log entries exist?
2. How can I mark that I've already detected a seg fault?

For 1 I guess I could grep out to >check_file and if the file size of check_file is greater than 0 bytes then there must be an entry.

For 2 I guess I could just then grep -v to remove the seg fault entries.

Anyone have any ideas on how to do this? Is it easy enough with Linux scripting or should I use php or perl and run that on the command line via a cron job?

If linux scripting then how can I detect if a file size is greater than 0 bytes?

I know this is not solving the original problem but I keep having to restart apache twice a day (at random times) and I'd really like to automate it until the problem is fixed.

[incywincy]

you could use cron to periodically restart apache, that would be the simplest dirtiest solution.

alternatively the unix command wc (word count) could be used to determine if your file has any contents

wc -l filename

returns the number of lines in filename, if non-zero restart apache

your best bet is to solve the problem rather than fix the symptom

[Romeo]

Another alternative is to let a script run and watching the log emulating a "tail -f":
It uses module File::Tail.

use File::Tail;
=File::Tail->new("/some/log/file");
while (defined(=->read)) {
if (/segmentation fault/) {
# do something;
}
}

Or try this perl code (seen on bugtraq list 1999):

open(ACCESS,"/bin/tail -f -c +0 $logfile ¦") ¦¦ die "Can't open tail of log file";
while(<ACCESS>) {
if(/segmentatuion fault/) {
# do something
}
}

Both untested though ...

Regards,
R.

The character after "$logfile" and the 2 characters before "die" are vertical bars

[Frank_Rizzo]

Cheers guys.

I'll knock something up as a temporary fix for this whilst the seg faults (11) are being investigated.

It points to hardware but I don't believe / trust that theory. The support droids will reseat the dimms but I just know the fault will return!

[Frank_Rizzo]

This is what I came up with:

#### log_check_faults
# Check Logfile for segmentation fault. If detected
# stop apache, remove entries from log, restart apache
#

cp /var/log/apache2/error_log /tmp/temp_log
grep -i segmentation /tmp/temp_log >/tmp/segmentation
if test -s /temp/segmentation
then
/etc/init.d/apache2 stop
grep -v -i segmentation /tmp/temp_log >/var/log/apache2/error_log
/etc/init.d/apache2 start
cat /tmp/segmentation ¦ mutt -s "Segmentation Fault Detected" [e-mail]
fi
rm /tmp/segmentation
rm /tmp/temp_log