Home > Articles

Logs and Monitoring

This chapter is from the book

This chapter is from the book

Creating Log Formats

   LogFormat "%h %l %u %t \"%r\" %>s %b" common

   LogFormat "%h %l %u %t \"%r\" %>s %b"
     
   \"%{Referer}i\" \"%{User-agent}i\"" combined

The LogFormat directive allows you to tell Apache which aspects of the request you want to record. You will still need additional directives to tell Apache where to log that information, but that is addressed in the next section. This example shows the configuration for the two most popular formats, the Common Log Format and the Combined Log Format. When Apache receives a request, it will substitute each one of the fields prefixed by a % with the corresponding request attribute. If you are using the CLF, each entry in your log file will look like this:

192.168.200.4 - someuser [12/Jun/2005:08:33:34
     +0500] "GET /example.png HTTP/1.0" 200 1234

If you are using the combined common format, each entry in your log file will look like this:

192.168.200.4 - someuser [12/Jun/2005:08:33:34
     +0500] "GET /example.png HTTP/1.0" 200 1234
     http://www.example.com/index.html "Mozilla/5.0
     (Windows; U; Windows NT 5.1; en-US; rv:1.7.7)"

Although the appendix provides a comprehensive logging format reference, this list describes the most important fields:

  • %h: The IP address of the client that sent the request to the web server, or the client's hostname if you have HostNameLookups enabled (192.168.200.4 in this example.)
  • %u: The user id of the user who sent the request determined by HTTP authentication (someuser in the example). See Chapter 6 for more details on how to configure HTTP-based authentication.
  • %t: Time when the request was received by the server.
  • %r: Text of the original request line from the client including the HTTP method used, the resource requested, and the HTTP protocol version used by the client's browser ("GET /example.png HTTP/1.0" in the example).
  • %>s: The final HTTP request status code that the web server sends back to the client (200 in the example, indicating that the request was completed successfully).
  • %b: The size in bytes of the object sent to the client in response to the request excluding the response headers (1234 in the example).

The combined log format extends the common log format with two additional fields. It is defined as

  • %{Referer}i: The Referer HTTP request header; that is, the web page that referred to the current document (http://www.example.com/index.html in the example).
  • %{User-agent}i: The User-agent HTTP request header. It includes information about the client's browser ("Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7)" in the example).
  • + Share This
  • 🔖 Save To Your Account