Hitchhiker's Guide to Openbsd

Log Rotation: Normally, logs are rotated by renaming the old files, then sending httpd(8) a 
SIGUSR1 signal to cause Apache to close its old log files and open new ones. This is no longer 
possible, as httpd(8) has no ability to open log files for writing once privileges are dropped. httpd
(8) must be stopped and restarted. It sometimes takes a few seconds for all the child processes to 
terminate, which must happen before httpd(8) can be restarted, so one possible way to rotate the 
logs would be as follows: 
# apachectl stop
rename your log files
# apachectl start ; sleep 10 ; apachectl start
Yes, the last line attempts to restart Apache immediately, and in case that fails it waits a few 
seconds and tries again. And yes, that does mean that for a few seconds every time you do your log 
rotation, your web server will be unavailable. While this could be annoying, any attempt to permit 
httpd(8) to reopen files after chroot(2)ing would defeat the very purpose of the chroot! There are 
also other strategies available, including logging to a 
pipe(2)
, and using an external log rotator at 
the other end of the pipe(2). 
●
Existing Apache modules: Virtually all will load, however some may not work properly in chroot
(2), and many have issues on "
apachectl
restart
", generating an error, which causes httpd
(8) to exit. 
●
Existing CGIs: Most will NOT work as is. They may need programs or libraries outside /var/www. 
Some can be fixed by compiling so they are statically linked (not needing libraries in other 
directories), most may be fixed by populating the /var/www directory with the files required by the 
application, though this is non-trivial and requires some knowledge of the program. 
http://www.openbsd.org/faq/faq10.html (22 of 32)9/4/2011 10:02:15 AM

---

10 - System Management
●