Appendix 2 - Log formats
|
Informations relating to the requests received by Apache can be logged into one or more log files tailored to an installation needs. The contents of a log file is defined by a format which is composed of a sequence of elements that identify the informations to be logged.
A format element is a code starting with a % and ending with a letter that identifies what the information is. Lower and upper cases have different meanings. For example:
| %h | represents the remote host |
| %H | represents the request protocol |
An example of a format is:
%h %t %r |
A log file with this format would record the following informations from each request:
| %h | remote host name |
| %t | time |
| %r | first line of the request |
A table of the format elements can be found in the "Apache Module mod_log_config" document, contained in the file "manual/mod/mod_log_config.html.en", under the heading CustomLog formats.
Here is this table, reproduced as is, for easy reference:
| Format String | Description | ||||||
|---|---|---|---|---|---|---|---|
%% |
The percent sign (Apache 2.0.44 and later) | ||||||
%...a |
Remote IP-address | ||||||
%...A |
Local IP-address | ||||||
%...B |
Bytes sent, excluding HTTP headers. | ||||||
%...b |
Bytes sent, excluding HTTP headers. In CLF format, i.e.
a '-' rather than a 0 when no bytes are sent. | ||||||
%...{Foobar}C |
The contents of cookie Foobar in the request sent to the server. | ||||||
%...D |
The time taken to serve the request, in microseconds. | ||||||
%...{FOOBAR}e |
The contents of the environment variable FOOBAR | ||||||
%...f |
Filename | ||||||
%...h |
Remote host | ||||||
%...H |
The request protocol | ||||||
%...{Foobar}i |
The contents of Foobar: header line(s)
in the request sent to the server. | ||||||
%...l |
Remote logname (from identd, if supplied) | ||||||
%...m |
The request method | ||||||
%...{Foobar}n |
The contents of note Foobar from another module. | ||||||
%...{Foobar}o |
The contents of Foobar: header line(s)
in the reply. | ||||||
%...p |
The canonical port of the server serving the request | ||||||
%...P |
The process ID of the child that serviced the request. | ||||||
%...{format}P |
The process ID or thread id of the child that serviced the
request. Valid formats are pid and tid.
(Apache 2.0.46 and later)
| ||||||
%...q |
The query string (prepended with a ? if a query
string exists, otherwise an empty string) | ||||||
%...r |
First line of request | ||||||
%...s |
Status. For requests that got internally redirected, this is
the status of the *original* request --- %...>s
for the last. | ||||||
%...t |
Time, in common log format time format (standard english format) | ||||||
%...{format}t |
The time, in the form given by format, which should be in
strftime(3) format. (potentially localized) | ||||||
%...T |
The time taken to serve the request, in seconds. | ||||||
%...u |
Remote user (from auth; may be bogus if return status
(%s) is 401) | ||||||
%...U |
The URL path requested, not including any query string. | ||||||
%...v |
The canonical ServerName(1)
of the server serving the request. | ||||||
%...V |
The server name according to the UseCanonicalName(2) setting. | ||||||
%...X |
Connection status when response is completed:
(This directive was | ||||||
%...I |
Bytes received, including request and headers, cannot be zero.
You need to enable mod_logio(3) to use this. | ||||||
%...O |
Bytes sent, including headers, cannot be zero. You need to
enable mod_logio(3) to use this. |
(1) see Apache document manual/mod/core.html ServerName directive
(2) see Apache document manual/mod/core.html UseCanonicalName directive
(3) see Apache document manual/mod/mod_logio.html
The first column ("Format string") contains the format element codes. The ... represents an optional list of one or more response statuses, with a dot (".") separating the statuses if the list has more than one. When one or more statuses are present, the information is to be recorded only if the response has one of these statuses. Example:
| %f | indicates that the requested file name is to be logged unconditionally |
| %401.404f | indicates the the requested file name is to be logged if the status of 401 or 404 is to be returned. |
Examples of commonly used log formats are to be found in the referenced document.
Previous Next Contents Glossary Index References Cover License