Apache (Web Server) - access log (CustomLog)
by
Jeremy Canfield |
Updated: November 25 2024
| Apache (Web Server) articles
The CustomLog directive in web servers configuration file (e.g. httpd.conf) is used to define the location of various log files, such as the access log, something like this.
CustomLog logs/access_log common
With this configuration, the access log would be located at:
<web_server_root>/logs/access_log
Notice the CustomLog directive also contains "common", which refers to the common LogFormat directive.
LogFormat "%h %l %u %t \"%r\" %>s %b %D %{WAS}e %X" common
| %a | client IP address (of the system issuing the request) |
| %A | local IP address (that's the IP address of the web server) |
| %b | size of the request, in bytes |
| %D | the time, in microseconds, that it took to serve the response |
| %h | IP address of the system issuing the request |
| %H | protocol, such as HTTP/1.1 |
| %I | name of the remote log or the - (dash) character if not included in the request |
| %m | method, such as GET, POST, PUT, CONNECT |
| %t | datetime the request was received |
| %r | method, such as GET, POST, PUT and the endpoint being requested, such as index.html |
| %s | the response code, such as 200 (OK) or 401 (unauthenticated) or 403 (forbidden) or 404 (not found) |
| %T | how many seconds it took to fulfill the request |
| %u | username being used in the request or the - (dash) character if not included in the request |
| %U | the endpoint or resource being requested |
| %V | the hostname of the server the request was submitted to |
| %v | the canonical hostname of the server the request was submitted to |
| %X | the connection status, X means the connection aborted before the response completed, + means the connection may be kept alive after the response is sent, - means the connection will be closed after the response is sent |
| %{WAS}e | the VARNAME variable, which is typically the hostname of the web server, such as example.com |
| %{Referer}i | the URL of the system that referred the request, which could be something like www.sample.com/some/end/point |
| %{User-Agent}i | The agent of the system issuing the request, such as "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" |
Here is an example of a request to get http://www.example.com/index.html.
10.15.112.57 - - [10/Oct/2020:21:36:16 -0400] "GET /index.html HTTP/1.1" 200 4153 130989 example.com +
Did you find this article helpful?
If so, consider buying me a coffee over at 