The CustomLog directive in web servers configuration file (e.g. httpd.conf) is used to define the location of various log files, such as the access log, something like this.

CustomLog logs/access_log common

With this configuration, the access log would be located at:

<web_server_root>/logs/access_log

Notice the CustomLog directive also contains "common", which refers to the common LogFormat directive.

LogFormat "%h %l %u %t \"%r\" %>s %b %D %{WAS}e %X" common

• %a - client IP address (of the system issuing the request)
• %A = local IP address (that's the IP address of the web server)
• %b = size of the request, in bytes
• %D = the time, in microseconds, that it took to serve the response
• %h = IP address of the system issuing the request
• %H = protocol, such as HTTP/1.1
• %l = name of the remote log or the - (dash) character if not included in the request
• %m = method, such as GET, POST, PUT, CONNECT
• %t = datetime the request was received
• %r = method, such as GET, POST, PUT and the endpoint being requested, such as index.html
• %s = status, such as 200 (OK) or 401 (unauthenticated) or 404 (not found)
• %u = username being used in the request or the - (dash) character if not included in the request
• %U = the base URL being requested
• %V = The hostname of the server the request was submitted to
• %v = The canonical hostname of the server the request was submitted to
• %X = the connection status
  • X = connection aborted before the response completed
  • + = connection may be kept alive after the response is sent
  • - = connection will be closed after the response is sent
• %{WAS}e = the VARNAME variable, which is typically the hostname of the web server, such as example.com
• %{Referer}i = The URL of the system that referred the request, which could be something like www.sample.com/some/end/point
• %{User-Agent}i = The agent of the system issuing the request, such as "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"

Here is an example of a request to get http://www.example.com/index.html.

10.15.112.57 - - [10/Oct/2020:21:36:16 -0400] "GET /index.html HTTP/1.1" 200 4153 130989 example.com +