Apache LogLevel: Control Error Log Detail by Level and Module

This article is a localized edition of the Japanese original. Read the Japanese original

LogLevel is the directive that decides how much detail Apache HTTP Server writes to the error log (the file set with ErrorLog). It does not affect the contents of the access log (CustomLog). This article follows the official Apache 2.4 documentation and reflects the situation as of November 2026.

LogLevel levels

Listed from most to least significant, the levels are as follows. Messages at the level you specify and at all more significant levels are recorded. For example, with LogLevel info, notice and warn messages are recorded too.

The default is warn. Note that when logging to a regular file, messages at the notice level cannot be suppressed by raising LogLevel and are always recorded (this does not apply when logging to syslog).

Where the configuration files are

LogLevel can be written for the whole server, or inside <VirtualHost>, <Directory> and similar sections. On the major distributions, the default LogLevel warn is in the following files.

To change it for a single virtual host, write it inside that site's <VirtualHost> in its configuration file (for example under /etc/apache2/sites-available/ on Debian-based systems, or under /etc/httpd/conf.d/ on RHEL-based systems).

Basic usage

This example changes the level for the whole server. Edit the existing LogLevel line (if there are two lines in the same place, the one written later takes effect).

LogLevel warn

This example makes only one virtual host more detailed.

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/example
    ErrorLog ${APACHE_LOG_DIR}/example-error.log
    LogLevel info
</VirtualHost>

${APACHE_LOG_DIR} is a variable defined in the Debian-based configuration. On RHEL-based systems, write something like logs/example-error_log.

Change the level per module

With the form module:level, you can change the level for a specific module only. A level written without a module name applies to all modules.

# info overall, warn for mod_ssl only
LogLevel info ssl:warn

The module name can be written in any of the following three ways, with the same meaning.

LogLevel info ssl:warn
LogLevel info mod_ssl.c:warn
LogLevel info ssl_module:warn

Tracing what mod_rewrite does

In Apache 2.4, the RewriteLog and RewriteLogLevel directives from 2.2 were removed, and mod_rewrite processing is logged with the trace levels of LogLevel.

LogLevel warn rewrite:trace3

Lines tagged with markers such as [rewrite:trace3] appear in the error log. Trace levels produce a lot of output and slow down processing, so set the level back once you have found the cause.

Change the level per directory

Written inside <Directory>, it changes the level only for messages about requests to that directory.

LogLevel info
<Directory "/var/www/example/app">
    LogLevel debug
</Directory>

This setting only affects messages tied to a request. Messages about connections or the server as a whole follow the outer LogLevel.

Applying the change

After editing the configuration, check the syntax and then reload.

Debian / Ubuntu:

sudo apachectl configtest
sudo systemctl reload apache2

RHEL / AlmaLinux / Rocky Linux:

sudo apachectl configtest
sudo systemctl reload httpd

If Syntax OK is not shown, fix the line indicated by the reported line number and reload again. After applying the change, access the target page while watching the error log and check how much is being recorded.

sudo tail -f /var/log/apache2/error.log

On RHEL-based systems, watch /var/log/httpd/error_log.

Which level to choose

Setting the whole server to debug or a trace level increases log volume, fills up the disk and makes processing heavier. The safer approach is to raise the level temporarily for just the module or directory you are investigating, then set it back when you are done. Also, at detailed levels the log can contain information you do not want exposed, such as request contents and file paths, so pay attention to who can read the log files.

Summary

• LogLevel decides how detailed the error log is. The default is warn
• Messages more significant than the specified level are recorded too
• You can change it per module, as in LogLevel info ssl:warn, and per directory inside <Directory>
• Investigate mod_rewrite with rewrite:trace3 or similar, and set it back afterward
• After a change, check with apachectl configtest, then apply with systemctl reload

How to spot suspicious access in the error and access logs is covered in Detecting attacks from Apache logs.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)