access_log file missing on certain date

[Fauziah Mahdan]

HI all, We have website log file at hpux 11.00 that we call urchin file under path /u01/ora9ias/app/9ias/Apache/Apache/logs/access_log.
It will track all client login to our website. The problem is the data was missing from 3june until 17 June. Which we not sure why and how to get it back?
We will initialize the report once we copy it out.
Pls advice

Fauziah Mahdan

[A. Clay Stephenson]

Offhand, I would say there there is a high probability that this htppd daemon was not running between those dates -- or you had no accesses. The log file is simply a text file so if you can't find the records with vi or grep then they don't exist. I am reading into your posting that you have entries in this file before 3-June and entries in the file after 17-June and I assume that the same file was in use at all times. It is possible that someone stopped httpd, altered the httpd.conf file's ServerRoot value, and then restored the original value at a later time so that the missing entries are under another directory.
You could do something like a "find / -type f -name 'access_log'" and see if any other access_log files on on your system but the bottom line is if you don't know where your missing entries are then it is highly unlikely that anyone other tha a psychic like Miss Cleo can help.

[Bill Hassell]

I would look at the Apache logfiles on your daily backup tapes to see if the logfile changes size between those two dates. If the logfile never changes size, then logging apparently was stopped during that time or the service was disabled.

[Fauziah Mahdan]

Thanks Clay yes the data was exist before 3rd june and after 17 june. we will initialize the file everytime we copy out the file. Is there any log file I can check whether the server having downtime (as far as I remember we do have down time but it was on 23rd June 06). BTW I will follow your advice to check on httpd.conf file and also try to find any other access_log file.


Thanks
Fauziah

[A. Clay Stephenson]

Bill's idea about looking at your Backups to see if the size of access_log changed during the missing days is a good one. It is also possible that someone restored the log file as it was just prior to 03-June and then restarted httpd on or near 18-June. In that case, the missing days are gone from the current file. However, if you have a backup of the file near to 17-June then you could restore that file to another location and then yank out the missing entries and insert them into your current file. If you don't have backups then you are almost certainly going to have to learn a valuable lesson: If you have good backups, you dont need them; if you don't have good backups then ... .

[A. Clay Stephenson]

Bill's idea about looking at your Backups to see if the size of access_log changed during the missing days is a good one. It is also possible that someone restored the log file as it was just prior to 03-June and then restarted httpd on or near 18-June. In that case, the missing days are gone from the current file. However, if you have a backup of the file near to 17-June then you could restore that file to another location and then yank out the missing entries and insert them into your current file. If you don't have backups then you are almost certainly going to have to learn a valuable lesson: If you have good backups, you don't need them; if you don't have good backups then ... .

[Fauziah Mahdan]

i 'll try to search any other access log for that montah. No need to talk about restore a backup file. Because our policy is 2 week time the tape will be reuse. So latest data in the tape already July data.
:-(
Never mind I think I found other access_log file that may contains of these data. Will try
thanks all


Fauziah