How to optimize access log performance in Apache

Access logging can become a measurable part of request cost on busy Apache hosts because every request still has to be formatted, filtered, and written before the transaction is fully out of the worker's path. Trimming log volume and log line width reduces disk churn, lowers CPU spent on formatting, and keeps high-frequency endpoints such as probes and static assets from dominating the access log.

Apache writes access logs through mod_log_config, mainly with LogFormat and CustomLog. Performance usually improves most by logging fewer fields, keeping HostnameLookups off so reverse DNS does not run per request, and excluding low-value traffic with environment-variable conditions instead of sending every hit through the same verbose format.

Examples below use the Debian and Ubuntu layout with /etc/apache2/, /var/log/apache2/, and the apache2 service name. RHEL-family systems usually use /etc/httpd/, /var/log/httpd/, and the httpd service name instead. HostnameLookups Off remains the right default for busy sites, but hostname-based Require rules can still trigger DNS work for access control, and BufferedLogs should be enabled only after the lighter format is verified because buffered writes can delay what appears in tail and can lose the newest entries after a crash.

1. Locate the active access-log directives before changing anything.

   $ sudo grep -R --line-number --extended-regexp '^[[:space:]]*(CustomLog|LogFormat|HostnameLookups|BufferedLogs)' /etc/apache2
   /etc/apache2/sites-enabled/000-default.conf:21:	CustomLog ${APACHE_LOG_DIR}/access.log combined
   /etc/apache2/sites-available/000-default.conf:21:	CustomLog ${APACHE_LOG_DIR}/access.log combined
   /etc/apache2/sites-available/default-ssl.conf:13:	CustomLog ${APACHE_LOG_DIR}/access.log combined
   /etc/apache2/conf-available/other-vhosts-access-log.conf:2:CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined
   /etc/apache2/conf-enabled/other-vhosts-access-log.conf:2:CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined
   /etc/apache2/apache2.conf:126:HostnameLookups Off
   /etc/apache2/apache2.conf:212:LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
   /etc/apache2/apache2.conf:213:LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
   /etc/apache2/apache2.conf:214:LogFormat "%h %l %u %t \"%r\" %>s %O" common
   /etc/apache2/apache2.conf:215:LogFormat "%{Referer}i -> %U" referer
   /etc/apache2/apache2.conf:216:LogFormat "%{User-agent}i" agent

   On RHEL-family systems, search /etc/httpd/ instead of /etc/apache2/.

2. Back up both the active virtual-host file and the main Apache configuration before editing them.

   $ sudo cp -a /etc/apache2/sites-available/000-default.conf /etc/apache2/sites-available/000-default.conf.bak
   $ sudo cp -a /etc/apache2/apache2.conf /etc/apache2/apache2.conf.bak

   Use the file paths returned by the previous grep when the active CustomLog lives in a different include or virtual-host file.

3. Confirm that HostnameLookups is still disabled.

   $ sudo grep -n '^[[:space:]]*HostnameLookups' /etc/apache2/apache2.conf
   126:HostnameLookups Off

   Apache 2.4 defaults HostnameLookups to Off, and heavily loaded sites should leave it there. If hostnames are needed later, run logresolve on saved IP addresses offline instead of forcing reverse DNS into every request.

4. Add a lighter log-format nickname near the existing LogFormat lines in /etc/apache2/apache2.conf.

   LogFormat "%a %t \"%r\" %>s %b" access_lite

   The %b field records response-body bytes without depending on mod_logio. Use %O only when exact on-wire bytes, including headers, matter. Append %D when request time in microseconds is worth the extra field.

5. Define skip rules for low-value requests in the same configuration context as the active CustomLog directive.

   SetEnvIfNoCase Request_URI "\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$" dontlog
   SetEnvIf Request_URI "^/healthz$" dontlog
   SetEnvIfNoCase User-Agent "^kube-probe/" dontlog

   The Request_URI attribute matches the path portion of the request line without the query string. If SetEnvIf or SetEnvIfNoCase is reported as an unknown directive, enable mod_setenvif first. Related: How to enable or disable Apache modules

6. Replace the existing CustomLog line with the lighter format and an exclusion condition.

   CustomLog ${APACHE_LOG_DIR}/access.log access_lite env=!dontlog

   Keep the backup files until the new format and skip rules are verified against real requests.

7. Test the updated configuration before reloading Apache.

   $ sudo apache2ctl configtest
   AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.4. Set the 'ServerName' directive globally to suppress this message
   Syntax OK

   Use sudo apachectl -t or sudo httpd -t on platforms that do not ship apache2ctl. The AH00558 message is a hostname warning, not a syntax failure.

   Related: How to test Apache configuration

8. Reload Apache so the new log format takes effect without dropping active connections.

   $ sudo systemctl reload apache2

   Use sudo systemctl reload httpd on most RHEL-family systems.

   Related: How to manage the Apache web server service

9. Send one request that should still be logged.

   $ curl -I -sS http://127.0.0.1/
   HTTP/1.1 200 OK
   Date: Thu, 09 Apr 2026 04:33:07 GMT
   Server: Apache/2.4.58 (Ubuntu)
   Last-Modified: Thu, 09 Apr 2026 04:33:04 GMT
   ETag: "29af-64eff832735bd"
   Accept-Ranges: bytes
   Content-Length: 10671
   Vary: Accept-Encoding

   Use the actual virtual-host hostname instead of 127.0.0.1 when the site is not served by the default host.

10. Send requests that should be excluded by the new skip rules.

    $ curl -I -sS http://127.0.0.1/favicon.ico
    HTTP/1.1 404 Not Found
    Date: Thu, 09 Apr 2026 04:33:07 GMT
    Server: Apache/2.4.58 (Ubuntu)
    Content-Type: text/html; charset=iso-8859-1
    
    $ curl -I -sS -A 'kube-probe/1.31' http://127.0.0.1/healthz
    HTTP/1.1 200 OK
    Date: Thu, 09 Apr 2026 04:33:07 GMT
    Server: Apache/2.4.58 (Ubuntu)
    Last-Modified: Thu, 09 Apr 2026 04:33:07 GMT
    ETag: W/"3-64eff835f2ddd"
    Accept-Ranges: bytes

11. Confirm that the excluded requests are missing from the access log.

    $ sudo grep -Fq 'favicon.ico' /var/log/apache2/access.log || echo 'favicon.ico skipped'
    favicon.ico skipped
    $ sudo grep -Fq 'healthz' /var/log/apache2/access.log || echo 'healthz skipped'
    healthz skipped

12. Review the most recent access-log line to confirm that the lighter format is active.

    $ sudo tail -n 1 /var/log/apache2/access.log
    127.0.0.1 [09/Apr/2026:04:33:07 +0000] "HEAD / HTTP/1.1" 200 -

    This shorter line drops logname, authenticated user, referer, and user-agent fields from the default combined format, which reduces both formatting work and log size.

13. Optionally enable buffered logging after the new format and skip rules are already proven.

    BufferedLogs On

    BufferedLogs is a global server setting, not a per-virtual-host setting. Apache 2.4 defaults it to Off. When it is enabled, low-traffic servers can delay writes enough that a new request may not appear immediately in tail -f, and a crash can lose buffered entries.

14. Re-test the configuration and reload Apache again if BufferedLogs was enabled.

    $ sudo apache2ctl configtest
    Syntax OK
    $ sudo systemctl reload apache2

    Related: How to test Apache configuration

    Related: How to manage the Apache web server service

15. Restore the backup files and reload Apache if the lighter format removes fields that are still needed for troubleshooting or audit work.

    $ sudo cp -a /etc/apache2/apache2.conf.bak /etc/apache2/apache2.conf
    $ sudo cp -a /etc/apache2/sites-available/000-default.conf.bak /etc/apache2/sites-available/000-default.conf
    $ sudo systemctl reload apache2