Apache (Web Server) - access log (CustomLog)

The CustomLog directive in web servers configuration file (e.g. httpd.conf) is used to define the location of various log files, such as the access log, something like this.

CustomLog logs/access_log common


With this configuration, the access log would be located at:



Notice the CustomLog directive also contains "common", which refers to the common LogFormat directive.

LogFormat "%h %l %u %t \"%r\" %>s %b %D %{WAS}e %X" common


  • %a - client IP address (of the system issuing the request)
  • %A = local IP address (that's the IP address of the web server)
  • %b = size of the request, in bytes
  • %D = the time, in microseconds, that it took to serve the response
  • %h = IP address of the system issuing the request
  • %H = protocol, such as HTTP/1.1
  • %l = name of the remote log or the - (dash) character if not included in the request
  • %m = method, such as GET, POST, PUT, CONNECT
  • %t = datetime the request was received
  • %r = method, such as GET, POST, PUT and the endpoint being requested, such as index.html
  • %s = status, such as 200 (OK) or 401 (unauthenticated) or 404 (not found)
  • %u = username being used in the request or the - (dash) character if not included in the request
  • %U = the base URL being requested
  • %V = The hostname of the server the request was submitted to
  • %v = The canonical hostname of the server the request was submitted to
  • %X = the connection status
    • X = connection aborted before the response completed
    • + = connection may be kept alive after the response is sent
    • - = connection will be closed after the response is sent
  • %{WAS}e = the VARNAME variable, which is typically the hostname of the web server, such as example.com
  • %{Referer}i = The URL of the system that referred the request, which could be something like www.sample.com/some/end/point
  • %{User-Agent}i = The agent of the system issuing the request, such as "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"

Here is an example of a request to get http://www.example.com/index.html. - - [10/Oct/2020:21:36:16 -0400] "GET /index.html HTTP/1.1" 200 4153 130989 example.com +


Did you find this article helpful?

If so, consider buying me a coffee over at Buy Me A Coffee

Add a Comment

We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.

Please enter 5fec8 in the box below so that we can be sure you are a human.


Web design by yours truely - me, myself, and I   |   jeremy.canfield@freekb.net   |