The question is about the access and error logs, particularly with multiple hosts (apache instances installed on more than one server) and keeping the logs centrally on a network file system.
Does apache close each log file after every write?
If yes, on a busy server hosting many sites each with it's own log, that would seem to be a potential performance bottleneck?
If No, what is the solution when having multiple servers writing to a single logging location on a network file system?
Does apache close each log file after every write?
Use the source, it is at: https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/modules/loggers/mod_log_config.c?view=markup
You can read from it:
251 * log_writer is NULL before the log file is opened and is 252 * set to a opaque structure (usually a fd) after it is opened. That kind of hints that it is open only once. In fact if you look at the code, it is open early, at initialization, and then never closed, for obvious performance reasons.
If No, what is the solution when having multiple servers writing to a single logging location on a network file system?
Absolutely never do that, for two reasons. First do not log remotely that way. Log locally (and ship logfiles separately, you can rotate hourly for example) or use the appropriate daemons, syslog knows by default how to ship log content by UDP (or TCP), as do newer solutions. Don't mount a remote disk and write logfiles to it, that will kill performance and create a whole bunch of problems (especially if you mean remote as in "NFS").
And even if locally, each application should log to its own logfile, don't have multiple applications logging to the same file, this is bound to create all kind of race conditions, overwrite, etc. Apache itself is one application even if it forks, but if you had 2 Apache running separately on the same host with different configurations, they should each log to their own logfiles.
Or look at Apache feature to log to pipes, but this has drawbacks too.
AFAIK you cannot have multiple Apache web servers concurrently write to the same log file.
For clusters you either let every node write to its own log file and then you do some post processing to merge them, or you let Apache generate syslog events, send those to a central syslog server where you can merge them into a single file or you use a log aggregation solution like ELK Stack, Graylog, Splunk and/or others to ship log events from all cluster nodes to a single big data database
