请问Apache server异常退出，哪里有记录

在SERVER上由于/TMP文件系统导致DISK FULL，Apache server 荡掉了。 Apache 的这种异常推出不知道哪里有记录，是在access_log，error-log里吗？

Server 用的是solaris 5.9

问这个问题的本意，就是想证明disk full 导致apache server 崩溃。想找hard evidence.


谢谢先

也就是问apache的正常或者异常推出在solaris 上有记录吗？

sorry

也就是问apache的正常或者异常的启动和退出在solaris 上有记录吗？

httpd-error.log

对不起，请问httpd-error.log在什么地方啊?

我只找到了access_log, error_log, 没有httpd-error.log

error_log就是的。

tail -n 100 error_log

下面是error_log的片断

[Wed Nov 01 12:28:58 2006] [info] [client 172.24.39.240] 1367728 11181 /RMA/getrmaproblemcodes.do - received msg1 keep-alive: 0, keepalives: 52
[Wed Nov 01 12:28:58 2006] [info] [client 172.24.39.240] 1367728 11181 /RMA/getrmaproblemcodes.[Wed Apr 11 11:43:49 2007] [debug] mod_ntlm.c(93): 8552 - Calling initialize_module first time
[Wed Apr 11 11:43:49 2007] [debug] mod_ntlm.c(93): 8553 - Creating global mutex ntlm_lock
[Wed Apr 11 11:43:49 2007] [debug] mod_ntlm.c(93): 8553 - Setting up cleanup function for ntlm_lock
[Wed Apr 11 11:43:49 2007] [notice] BEA plugin build date/time: Dec  5 2006 10:58:23. Change Number: 871803
[Wed Apr 11 11:43:49 2007] [info] mod_weblogic: init_mod: mpm doesn't support threads.
[Wed Apr 11 11:43:49 2007] [debug] mod_ntlm.c(93): 8554 - Calling apr_global_mutex_child_init with lockfile /var/tmp/aaa1iaiTq
[Wed Apr 11 11:43:49 2007] [info] mod_weblogic: init_child: isThreaded = -1
[Wed Apr 11 11:43:49 2007] [info] mod_weblogic: Testing Debug=(null) LogFile=(null) TempDir=(null)
[Wed Apr 11 11:43:49 2007] [info] mod_weblogic: created global log context in child
[Wed Apr 11 11:43:50 2007] [debug] mod_ntlm.c(93): 8555 - Calling apr_global_mutex_child_init with lockfile /var/tmp/aaa1iaiTq
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: init_child: isThreaded = -1
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: Testing Debug=(null) LogFile=(null) TempDir=(null)
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: created global log context in child
[Wed Apr 11 11:43:50 2007] [debug] mod_ntlm.c(93): 8556 - Calling apr_global_mutex_child_init with lockfile /var/tmp/aaa1iaiTq
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: init_child: isThreaded = -1
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: Testing Debug=(null) LogFile=(null) TempDir=(null)
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: created global log context in child
[Wed Apr 11 11:43:50 2007] [debug] mod_ntlm.c(93): 8557 - Calling apr_global_mutex_child_init with lockfile /var/tmp/aaa1iaiTq
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: init_child: isThreaded = -1
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: Testing Debug=(null) LogFile=(null) TempDir=(null)
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: created global log context in child
[Wed Apr 11 11:43:50 2007] [notice] Apache/2.0.55 (Unix) configured -- resuming normal operations
[Wed Apr 11 11:43:50 2007] [info] Server built: Jan 19 2006 16:21:10
[Wed Apr 11 11:43:50 2007] [debug] prefork.c(956): AcceptMutex: fcntl (default: fcntl)
[Wed Apr 11 11:43:50 2007] [debug] mod_ntlm.c(93): 8558 - Calling apr_global_mutex_child_init with lockfile /var/tmp/aaa1iaiTq
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: init_child: isThreaded = -1
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: Testing Debug=(null) LogFile=(null) TempDir=(null)
[Wed Apr 11 11:43:50 2007] [info] mod_weblogic: created global log context in child
[Wed Apr 11 11:44:00 2007] [debug] mod_ntlm.c(93): 8559 - Calling apr_global_mutex_child_init with lockfile /var/tmp/aaa1iaiTq
[Wed Apr 11 11:44:00 2007] [info] mod_weblogic: init_child: isThreaded = -1
[Wed Apr 11 11:44:00 2007] [info] mod_weblogic: Testing Debug=(null) LogFile=(null) TempDir=(null)
[Wed Apr 11 11:44:00 2007] [info] mod_weblogic: created global log context in child
[Wed Apr 11 11:44:08 2007] [debug] mod_ntlm.c(93): 8560 - Calling apr_global_mutex_child_init with lockfile /var/tmp/aaa1iaiTq
[Wed Apr 11 11:44:08 2007] [info] mod_weblogic: init_child: isThreaded = -1
[Wed Apr 11 11:44:08 2007] [info] mod_weblogic: Testing Debug=(null) LogFile=(null) TempDir=(null)
[Wed Apr 11 11:44:08 2007] [info] mod_weblogic: created global log context in child
[Wed Apr 11 11:44:11 2007] [debug] mod_ntlm.c(93): 8561 - Calling apr_global_mutex_child_init with lockfile /var/tmp/aaa1iaiTq
[Wed Apr 11 11:44:11 2007] [info] mod_weblogic: init_child: isThreaded = -1
[Wed Apr 11 11:44:11 2007] [info] mod_weblogic: Testing Debug=(null) LogFile=(null) TempDir=(null)
[Wed Apr 11 11:44:11 2007] [info] mod_weblogic: created global log context in child

已知server当掉的时间大概在10:50-11:30am. 但是我没有看到任何的记录阿

下面是access_log的片断
172.22.12.27 - - [11/Apr/2007:11:00:22 -0400] "POST /CapacityR2Web/ApptDetails/SelectOverrideDate.do HTTP/1.1" 401 488
172.22.12.27 - khalil.fofana [11/Apr/2007:11:00:22 -0400] "POST /CapacityR2Web/ApptDetails/SelectOverrideDate.do HTTP/1.1" 200 20729
172.22.12.27 - - [11/Apr/2007:11:00:22 -0400] "GET /CapacityR2Web/resources/js/availcal.js HTTP/1.1" 401 488
172.22.12.27 - - [11/Apr/2007:11:00:22 -0400] "GET /CapacityR2Web/resources/js/availcal.js HTTP/1.1" 401 488
172.22.12.27 - khalil.fofana [11/Apr/2007:11:00:22 -0400] "GET /CapacityR2Web/resources/js/availcal.js HTTP/1.1" 304 -
142.182.50.68 - - [11/Apr/2007:11:00:31 -0400] "GET / HTTP/1.1" 200 1456
142.182.50.68 - - [11/Apr/2007:11:44:00 -0400] "GET / HTTP/1.1" 200 1456
142.182.50.68 - - [11/Apr/2007:11:44:08 -0400] "GET / HTTP/1.1" 200 1456
172.22.12.105 - - [11/Apr/2007:11:44:10 -0400] "GET /CapacityR2Web/Controller.jpf HTTP/1.1" 401 479
172.22.12.105 - - [11/Apr/2007:11:44:17 -0400] "GET /CapacityR2Web/Controller.jpf HTTP/1.1" 401 479
172.22.12.105 - laura.bancheri1 [11/Apr/2007:11:44:17 -0400] "GET /CapacityR2Web/Controller.jpf HTTP/1.1" 200 1232
1

可以看到在11：00am-11:44am之间有一个间断。在这个时间段，没有任何的异常信息

都是info或者debug级别的，出错的话起码应该是warn级别的日志

这就是我比较郁闷的地方了

在上面error_log中， 有一个时间上的大跳跃，从2006年一下跳到2007年4月11号11：44am. 这当中的没有记录任何的log 信息。 莫非在过去的一年中什么错误都没有？不可能阿！！！2007年4月11号11：44am 应该是我重启apache server的时间

我check 了httpd.conf, 找到如下设定
LogLevel debug
照理高于debug级别的log信息应该都记录阿，包括error, crit, emerg 等等

不知道发生了什么事

找一个证据如此之难

是否有被入侵？