# 配置错误日志
ErrorLog /var/log/apache2/error.log

# 日志级别
LogLevel warn

# 基本配置
CustomLog /var/log/apache2/access.log combined

# 虚拟主机独立日志
<VirtualHost *:80>
    ServerName www.example.com
    ErrorLog /var/www/example.com/logs/error.log
    CustomLog /var/www/example.com/logs/access.log combined
</VirtualHost>

# 预定义格式
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

# 详细调试格式
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D %T" detailed

# JSON 格式（便于日志分析）
LogFormat "{ \
  \"remote_ip\": \"%h\", \
  \"timestamp\": \"%{%Y-%m-%dT%H:%M:%S%z}t\", \
  \"method\": \"%m\", \
  \"url\": \"%U\", \
  \"query\": \"%q\", \
  \"status\": %>s, \
  \"size\": %B, \
  \"referer\": \"%{Referer}i\", \
  \"user_agent\": \"%{User-Agent}i\", \
  \"response_time\": %D, \
  \"forwarded_for\": \"%{X-Forwarded-For}i\" \
}" json

# 安全审计格式
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-Forwarded-For}i\" \"%{Cookie}i\"" security

# 性能监控格式
LogFormat "%h %t \"%r\" %>s %b %D %T %{Referer}i" performance

# 带虚拟主机名的格式
LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined

# 使用 env= 条件记录
CustomLog /var/log/apache2/access.log combined
CustomLog /var/log/apache2/agents.log agent env=log_agent
CustomLog /var/log/apache2/referer.log referer env=log_referer

# 基于请求设置环境变量
SetEnvIf Request_URI "\.(gif|jpg|png|css|js)$" dontlog
CustomLog /var/log/apache2/access.log combined env=!dontlog

# 不记录健康检查
SetEnvIf User-Agent "ELB-HealthChecker" dontlog
SetEnvIf User-Agent "Uptime" dontlog
CustomLog /var/log/apache2/access.log combined env=!dontlog

# 仅记录错误请求
CustomLog /var/log/apache2/errors.log combined %>400

# 记录特定路径
SetEnvIf Request_URI "^/api/" api_request
CustomLog /var/log/apache2/api.log combined env=api_request

# 使用管道日志处理
CustomLog "|/usr/bin/rotatelogs /var/log/apache2/access.%Y%m%d.log 86400" combined

# 使用 cronolog
CustomLog "|/usr/bin/cronolog /var/log/apache2/access.%Y%m%d.log" combined

# 压缩日志
CustomLog "|/bin/gzip > /var/log/apache2/access.log.gz" combined

# 发送到 syslog
CustomLog "|/usr/bin/logger -t apache -p local1.info" combined
ErrorLog syslog:local1

# 每天轮转
CustomLog "|/usr/bin/rotatelogs /var/log/apache2/access.%Y-%m-%d.log 86400" combined

# 每 100MB 轮转
CustomLog "|/usr/bin/rotatelogs /var/log/apache2/access.log 104857600" combined

# 保留 365 天
CustomLog "|/usr/bin/rotatelogs -l /var/log/apache2/access.%Y-%m-%d.log 86400 +365" combined

# /etc/logrotate.d/apache2
/var/log/apache2/*.log {
    daily
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 640 root adm
    sharedscripts
    postrotate
        if /etc/init.d/apache2 status > /dev/null ; then
            /etc/init.d/apache2 reload > /dev/null
        fi
    endscript
}

# 测试 logrotate
sudo logrotate -d /etc/logrotate.d/apache2
sudo logrotate -f /etc/logrotate.d/apache2

# /etc/logrotate.d/apache2-vhosts
/var/www/*/logs/*.log {
    weekly
    missingok
    rotate 12
    compress
    delaycompress
    notifempty
    create 640 www-data www-data
    sharedscripts
    postrotate
        if /etc/init.d/apache2 status > /dev/null ; then
            /etc/init.d/apache2 reload > /dev/null
        fi
    endscript
}

# 基本统计
wc -l /var/log/apache2/access.log

# 统计独立 IP
awk '{print $1}' access.log | sort -u | wc -l

# 最活跃 IP（Top 10）
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10

# 统计状态码
awk '{print $9}' access.log | sort | uniq -c | sort -rn

# 统计 404 请求
awk '$9 == 404 {print $7}' access.log | sort | uniq -c | sort -rn | head -20

# 统计请求方法
awk '{print $6}' access.log | sort | uniq -c | sort -rn

# 统计每小时请求量
awk '{print $4}' access.log | cut -d: -f2 | sort | uniq -c

# 统计带宽使用
awk '{sum+=$10} END {print sum/1024/1024/1024 " GB"}' access.log

# 统计慢请求（响应时间 > 1s）
awk '$NF > 1000000 {print}' access.log

# 统计特定页面访问
grep "/products" access.log | wc -l

# 统计搜索引擎爬虫
grep -i "bot\|crawl\|spider" access.log | awk '{print $1}' | sort | uniq -c | sort -rn

# 检测暴力破解
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20

# 检测 401 错误
awk '$9 == 401 {print $1, $7}' access.log | sort | uniq -c | sort -rn

# 检测可疑请求
grep -E "(union|select|insert|update|delete|drop|exec|eval|alert)" access.log

# 检测目录遍历
grep "\.\./" access.log

# 检测 SQL 注入尝试
grep -iE "('|%27)(\s|%20)*(or|and|union|select)" access.log

# 检测 XSS 尝试
grep -iE "(<script|javascript:|on\w+\s*=)" access.log

# 检测文件包含尝试
grep -iE "(etc/passwd|etc/shadow|proc/self)" access.log

# 统计攻击 IP
grep -E "(400|401|403|404)" access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# 统计响应时间
awk '{print $NF}' access.log | sort -n | tail -10

# 平均响应时间
awk '{sum+=$NF; count++} END {print sum/count " 微秒"}' access.log

# 响应时间分布
awk '{
  if ($NF < 100000) fast++
  else if ($NF < 500000) medium++
  else if ($NF < 1000000) slow++
  else very_slow++
} END {
  print "快速 (<100ms): " fast
  print "中等 (100-500ms): " medium
  print "慢速 (500ms-1s): " slow
  print "很慢 (>1s): " very_slow
}' access.log

# 统计每分钟请求量
awk '{print $4}' access.log | cut -d: -f1-3 | uniq -c | sort -rn | head -20

# 统计每秒请求数峰值
awk '{print $4}' access.log | cut -d: -f1-4 | uniq -c | sort -rn | head -10

# 安装
sudo apt install goaccess

# 实时分析
goaccess /var/log/apache2/access.log --log-format=COMBINED -c

# 生成 HTML 报告
goaccess /var/log/apache2/access.log --log-format=COMBINED -o /var/www/html/report.html

# JSON 格式分析
goaccess /var/log/apache2/access.log --log-format=COMBINED -o report.json --json

# JSON 日志格式
goaccess /var/log/apache2/access.log --log-format='{ %h %^[%^] "%r" %s %b "%R" "%u" }' -o report.html

# 安装
sudo apt install awstats

# 配置 /etc/awstats/awstats.www.example.com.conf
LogFile="/var/log/apache2/access.log"
LogFormat=1
SiteDomain="www.example.com"
HostAliases="example.com"
DNSLookup=0

# 生成统计
sudo /usr/lib/cgi-bin/awstats.pl -config=www.example.com -update

# 配置 Apache 访问
Alias /awstats/classes "/usr/share/awstats/lib/"
Alias /awstats-icon "/usr/share/awstats/icon/"
ScriptAlias /cgi-bin/ "/usr/lib/cgi-bin/"

<Directory "/usr/lib/cgi-bin/">
    AllowOverride None
    Options +ExecCGI
    Require ip 192.168.1.0/24
</Directory>

# Filebeat 配置
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/apache2/access.log
  fields:
    type: apache-access

- type: log
  enabled: true
  paths:
    - /var/log/apache2/error.log
  fields:
    type: apache-error

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "apache-%{+yyyy.MM.dd}"

# 每个站点独立日志
<VirtualHost *:80>
    ServerName site1.example.com
    ErrorLog /var/www/site1/logs/error.log
    CustomLog /var/www/site1/logs/access.log combined
</VirtualHost>

<VirtualHost *:80>
    ServerName site2.example.com
    ErrorLog /var/www/site2/logs/error.log
    CustomLog /var/www/site2/logs/access.log json
</VirtualHost>

#!/bin/bash
# monitor-apache.sh

LOG="/var/log/apache2/access.log"
ERROR_LOG="/var/log/apache2/error.log"

# 检查错误率
ERROR_RATE=$(awk '$9 >= 500' $LOG | wc -l)
TOTAL=$(wc -l < $LOG)
RATE=$((ERROR_RATE * 100 / TOTAL))

if [ $RATE -gt 5 ]; then
    echo "警告：错误率 ${RATE}%" | mail -s "Apache 错误率告警" admin@example.com
fi

# 检查响应时间
SLOW_REQUESTS=$(awk '$NF > 5000000' $LOG | wc -l)
if [ $SLOW_REQUESTS -gt 100 ]; then
    echo "警告：${SLOW_REQUESTS} 个慢请求" | mail -s "Apache 性能告警" admin@example.com
fi