Understanding and Using the splitlogs Binary in cPanel & WHM

1. Overview

The /usr/local/cpanel/bin/splitlogs binary optimizes Apache log handling by reducing the number of open log files and improving performance. It works in conjunction with Apache’s piped logs functionality and is enabled when the Enable Piped Apache Logs setting is active in WHM’s Apache Configuration interface.

By default, Apache opens two log files per virtual host (byte log and access log). The splitlogs binary reduces memory usage by opening only one log file per request and routing log entries efficiently.

cPanel & WHM runs two instances of splitlogs: one for byte logs and one for access logs. The binary extracts the domain and port from each request and writes logs to the appropriate file.

Note: Requests to a shared IP address are only written to Apache’s main byte and access logs, not to domain‑specific logs.

---

2. Syntax

To run the splitlogs binary:

/usr/local/cpanel/bin/splitlogs [arguments]

---

3. Arguments

3.1 Build Arguments

Argument	Description	Example
--bincheck	Verifies that the splitlogs binary was built correctly.	/usr/local/cpanel/bin/splitlogs --bincheck

---

3.2 Apache Configuration Arguments

Argument	Description	Example
--dir	Specifies the directory where Apache log files are stored.	/usr/local/cpanel/bin/splitlogs --dir="/logs/apache"
--suffix	Sets the suffix for non‑SSL access logs.	/usr/local/cpanel/bin/splitlogs --suffix=".logs"
--sslsuffix	Sets the suffix for SSL access logs.	/usr/local/cpanel/bin/splitlogs --sslsuffix="ssl_log"
--sslport	Specifies the SSL port number (default: 443).	/usr/local/cpanel/bin/splitlogs --sslport="8080"
--main	Defines the server hostname for default log routing.	/usr/local/cpanel/bin/splitlogs --main="host.example.com"
--mainout	Specifies the default access log file path.	/usr/local/cpanel/bin/splitlogs --mainout="/logs/apache/host.example.com.log"

---

3.3 Performance Tweaking Arguments

Argument	Description	Example
--maxopen	Sets the maximum number of log files that can be open simultaneously.	/usr/local/cpanel/bin/splitlogs --maxopen=20000
--buffer	Enables or disables buffered file writing (yes or no).	/usr/local/cpanel/bin/splitlogs --buffer=yes

---

4. More About the --maxopen Argument

Warning: Setting --maxopen too high may cause OS file‑handle issues. If this happens, the system resets the value to the default (16000).

Guidelines:

• Low values reduce performance due to frequent file open/close operations.
• High values increase memory usage and system load.
• Use real traffic patterns to determine the best value.

Files are closed when:

• The maximum open file limit is reached.
• Log or bandwidth processing occurs.
• Apache restarts.

---

5. More About the --buffer Argument

The --buffer argument controls buffered file writing.

Defaults:

• Enabled unless /var/cpanel/conserve_memory exists.

Pros of enabling buffering:

• Faster log writing

Cons:

• Higher memory usage
• Risk of data loss if splitlogs exits before flushing buffers
• Reduced performance on overloaded systems

---

6. The splitlogs Configuration File

When Apache’s configuration is rebuilt, cPanel reads:

/var/cpanel/conf/splitlogs.conf

This file contains key=value pairs matching the command‑line arguments.

Important: After modifying this file, rebuild and restart Apache:

/usr/local/cpanel/scripts/rebuildhttpdconf
/scripts/restartsrv_httpd

---

7. Performance Notes

The splitlogs binary logs a message every time it reaches 1,000× its file‑handle limit.

Guidance:

• If you never see these messages → lower --maxopen
• If you see too many messages → increase --maxopen

Reevaluate settings whenever server load or domain count changes.

---

Conclusion

The splitlogs binary is a powerful optimization tool for Apache log handling in cPanel & WHM. By understanding its arguments, configuration file, and performance considerations, administrators can significantly improve log efficiency and reduce system load.