How often does your (shared) webhost rotate error logs?

My host rotates error logs every hour which I find unusable!

[penders]

Surely 1 hour is way too short?! What happens to your error logs? What's normal?

[maximillianos]

I don't typically require much history on error logs. If there is a problem, the real-time latest log entries are what I want to see. One hour seems okay to me.

Unfortunately you are probably at the mercy of the host since this is a shared account. If you need more flexibility, perhaps you could setup a cron job to archive off the error log every hour to your local/shared account?

[Demaestro]

Ya an hour isn't that long, if you want to look up a user error but it was reported to you over an hour later it isn't much help.

The shared account I have had were typically for a day with a compressed file of days previous.

So there were typically 2 error_log files for me, one in plain text that was the current day and 1 compressed file that had the 2 previous days.

Another thing to check is to see if they do it by file size rather than time. I could be your error log is just reaching a size limit in about an hour.

Just ask your host if instead of deleting out your log if they can archive it somewhere and have it go a couple days back.

[penders]

Ya an hour isn't that long, if you want to look up a user error but it was reported to you over an hour later it isn't much help.

This is exactly what's happened.

Another thing to check is to see if they do it by file size rather than time. I could be your error log is just reaching a size limit in about an hour.

Well, in my case, it is 1 hour. (Up to a max of 300 messages in that hour.) I have seen with my own eyes, a log with just 2 entries get truncated.

Awaiting response from host...

[Demaestro]

I have seen with my own eyes, a log with just 2 entries get truncated.

Ouch, that would drive me crazy. When I worked for a development house we had a gig limit on each error_log when I left and got a reseller host account I was shocked to find they only held them for 3-4 days max... I thought that was bad.

Is it the same for your access_logs? Those I use even more then the error_logs, to track "suspect" hits, see what IPs are trying to hit my pages with trying to spoof query strings... looking up hot-linked images... all that stuff... you need to have a few days back on that for sure.

[penders]

Is it the same for your access_logs?

Well, that's the thing... access_logs are no problem. As well as viewing recent activity, the access log is archived every 24 hours and each month is then archived (and kept) separately that I can download/delete as required. I can keep several months of archived access logs without a problem! So with this in mind I would have expected some leniency regarding the error_log.

[Demaestro]

A recent story of how error_log can be useful.

I for no real reason decided to peak in on some error logs just out of boredom and I found 1 site with a crap ton of 404s.

They were all for favicon.ico which reminded me I hadn't set up a favicon for that site. So I made one up. They are just nice to have, an hour seems woefully inadequate.

[phranque]

do they actually delete your error logs or simply archive them.
if they are archived you can write a script to reconcatenate them on a daily or weekly basis.

dmaestro:
you can find the 404's in the access log.
the error log is mostly to get an explanation for the 500's.