A prerequisite to analyzing our server's logs is taking them off line. While piping the logs into a program such as the Apache distribution's rotatelogs is one way that we'll revisit shortly, most sites use a log rotation script or a utility such as Red Hat's logrotate (8) to move the logs to a new name and restart the server. The script might be something as simple as

#!/bin/sh

LOGDIR='/usr/local/apache/logs'
LOGDATE=`date +"%Y-%m-%d:%T:%Z"`
mv $LOGDIR/access_log $LOGDIR/$LOGDATE.access_log
mv $LOGDIR/error_log $LOGDIR/$LOGDATE.error_log
kill -HUP `cat $LOGDIR/httpd.pid`

The output of `date +"%Y-%m-%d:%T:%Z"` will look something like

1999-07-22:17:00:00:PDT

so the log file will have the time of the rotation timestamped into the filename. In practice, you'll want to compress the logs with gzip after the rotation.