OLS Log Management

Managing OpenLiteSpeed Logs

Proper log management is critical for troubleshooting, security monitoring, and performance analysis. BlitzPress organizes logs by site for easy management.

Log File Locations

Log	Path	Purpose
OLS Server Error	/usr/local/lsws/logs/error.log	Server-level errors (config, startup)
OLS Server Access	/usr/local/lsws/logs/access.log	All requests (if server-level logging enabled)
Site Error Log	/home/DOMAIN/logs/error.log	Per-site PHP and application errors
Site Access Log	/home/DOMAIN/logs/access.log	Per-site request log
PHP Slow Log	/home/DOMAIN/logs/php-slow.log	Slow PHP function traces
WordPress Debug	/home/DOMAIN/public_html/wp-content/debug.log	WP_DEBUG output

Log Rotation

OLS has built-in log rotation via the rollingSize directive. In the vhost config:

accessLog /home/DOMAIN/logs/access.log {
  rollingSize             100M
  keepDays                30
  compressArchive         1
}

errorLog /home/DOMAIN/logs/error.log {
  rollingSize             50M
  keepDays                30
  logLevel                ERROR
}

Logs are automatically rotated when they reach the specified size, compressed, and deleted after the retention period.

Analyzing Access Logs

Common log analysis commands:

# Top 20 IPs by request count
awk '{print $1}' /home/DOMAIN/logs/access.log | sort | uniq -c | sort -rn | head -20

# Top 20 most requested URLs
awk '{print $7}' /home/DOMAIN/logs/access.log | sort | uniq -c | sort -rn | head -20

# All 404 errors
grep " 404 " /home/DOMAIN/logs/access.log | awk '{print $7}' | sort | uniq -c | sort -rn

# Requests per hour
awk '{print $4}' /home/DOMAIN/logs/access.log | cut -d: -f1-2 | sort | uniq -c

Common Error Patterns

[STDERR] PHP Fatal error — check the full error message for file and line
connection reset by peer — client disconnected, usually harmless
lsphp is not available — PHP workers exhausted or crashed
max connections reached — increase maxConns in extprocessor

Real-Time Log Monitoring

# Watch errors in real time
tail -f /home/DOMAIN/logs/error.log

# Watch with filtering
tail -f /home/DOMAIN/logs/error.log | grep -i "fatal\|critical"