How can I configure Cobalt Apache to log cookies for use with Urchin Tracking Module

NOTICE! The following is an unsupported workaround for Cobalt web servers. Implementing this workaround may void your Cobalt warrantee. Therefore Urchin Software does not recommend its use. The following documentation is provided as a reference tool only.

Cobalt maintains a single "access" log for the server. Part of the log management mechanism for all Cobalt servers requires that a script run based on a special configuration file to parse the access log into separate domain log files. This process is configured in a way that restricts modification of the "access" log format via the Apache configuration file "httpd.conf."

If you want to use the UTM module with Urchin 4, you must edit Cobalt's Apache configuration file without compromising the existing access log file. In preliminary tests, we have successfully added a line to the httpd.conf file that creates a duplicate "access" log file under another name. Since the Cobalt server does not use that file, it will not have any impact on the existing log rotation mechanism.

Editing the httpd.conf file: You can find the httpd.conf file in /etc/httpd/conf/httpd.conf
Using a text editor, open the httpd.conf file and locate the LogFormat settings.
Add the following line to the existing LogFormat entries:

LogFormat "%h %v %u %t \"%r\" %>s %b \"%{Referer}i\"
\"%{User-Agent}i\" \"%{Cookie}i\"" special

Now, under the current "CustomLog" entry, add the following line:
CustomLog /var/log/httpd/urchin special

So, your CustomLog entries, should now look like this:
CustomLog /var/log/httpd/access combined
CustomLog /var/log/httpd/urchin special

Restart the web server from the control panel so the changes will take affect. Apache will immediately begin writing the new log file which will include all traffic to all domains on the server. The only difference will be the addition of the cookie data.

Setting up Profiles to Utilize the new UTM log: The standard setup for Urchin 4 on Cobalt allows you to use the individual web.log files which are created for each domain. In this scenario, you would have to use the same /var/log/httpd/urchin log for every profile. Each profile would have to use a filter to include "only" the hits that were directed to the domain in question.

For example, if my profile name is, then my profile filter would have the following parameters: Filter Type: Include Pattern ONLY
Filter Field: Requested Host
Filter Pattern: urchin\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\.com

All other aspects of the profile can be setup using the standard procedures outlined in the Urchin UTM document.

The newly created log will have to be periodically cleared or it will grow daily without limitation. Therefore, it will be necessary to implement a rotation of some sort. If you simply wish to clear the contents periodically, the following may be useful:

From the command line, while logged in as "root", create a file with the following contents:
cp /dev/null /var/log/httpd/urchin
This file should have execute permissions for the 'root' owner.
The file should be saved in the /etc/cron.daily/ directory. Alternatively, you can save into /etc/cron.weekly. Whichever you choose, it will be crucial to schedule Urchin "around" this log maintenance routine. Cobalt runs all files in the cron.daily and cron.weekly directories starting at 4:00am. So, Urchin should be scheduled such that it completes processing all UTM profiles before 4am. The length of time it takes for Urchin to process is entirely dependent on the size of the log files and complexity of the configuration for each profile. DNS processing will also impact this metric. So, you will have to run Urchin a few times before adding the log maintenance routine to the cron.daily directory.