- Introduction to Logging in Apache
- Default Apache Log Files
- Creating Log Formats
- Creating a Custom Log File
- Redirecting Logs to an External Program
- Logging Requests Conditionally
- Monitoring Who Is Linking to Your Website
- Monitoring Apache with mod_status
- Monitoring Apache with SNMP
- Analyzing Your Logs with Open-source Tools
- Monitoring Your Logs in Real Time
- Logging Requests to a Database
- Rotating and Archiving Logs
- Controlling IP Address Resolution
- Processing Logged IP Addresses
- Restarting Apache Automatically If It Fails
- Merging and Splitting Log Files
- Keeping Separate Logs for Each Virtual Host
- Common Log Entries
This chapter is from the book
This chapter is from the book
This chapter is from the book
Creating Log Formats
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%h %l %u %t \"%r\" %>s %b"
\"%{Referer}i\" \"%{User-agent}i\"" combined
The LogFormat directive allows you to tell Apache which aspects of the request you want to record. You will still need additional directives to tell Apache where to log that information, but that is addressed in the next section. This example shows the configuration for the two most popular formats, the Common Log Format and the Combined Log Format. When Apache receives a request, it will substitute each one of the fields prefixed by a % with the corresponding request attribute. If you are using the CLF, each entry in your log file will look like this:
192.168.200.4 - someuser [12/Jun/2005:08:33:34
+0500] "GET /example.png HTTP/1.0" 200 1234
If you are using the combined common format, each entry in your log file will look like this:
192.168.200.4 - someuser [12/Jun/2005:08:33:34
+0500] "GET /example.png HTTP/1.0" 200 1234
http://www.example.com/index.html "Mozilla/5.0
(Windows; U; Windows NT 5.1; en-US; rv:1.7.7)"
Although the appendix provides a comprehensive logging format reference, this list describes the most important fields:
- %h: The IP address of the client that sent the request to the web server, or the client's hostname if you have HostNameLookups enabled (192.168.200.4 in this example.)
- %u: The user id of the user who sent the request determined by HTTP authentication (someuser in the example). See Chapter 6 for more details on how to configure HTTP-based authentication.
- %t: Time when the request was received by the server.
- %r: Text of the original request line from the client including the HTTP method used, the resource requested, and the HTTP protocol version used by the client's browser ("GET /example.png HTTP/1.0" in the example).
- %>s: The final HTTP request status code that the web server sends back to the client (200 in the example, indicating that the request was completed successfully).
- %b: The size in bytes of the object sent to the client in response to the request excluding the response headers (1234 in the example).
The combined log format extends the common log format with two additional fields. It is defined as
- %{Referer}i: The Referer HTTP request header; that is, the web page that referred to the current document (http://www.example.com/index.html in the example).
- %{User-agent}i: The User-agent HTTP request header. It includes information about the client's browser ("Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7)" in the example).