Apache Log Format

The LogFormat directive is used to define a log format, and a friendly name refering to that format.

example, in the httpd.conf file, you’ll find:

LogFormat “%h %l %u %t \”%r\” %>s %b” common
This directive creates a log format called “common”, which is in the format specified in quotes. Each one of those letters means a particular piece of information, which is written in the log file in the order indicated.

The available variables, and their meanings, are listed in the apache documentation, But here they are

%…a: Remote IP-address
%…A: Local IP-address
%…B: Bytes sent, excluding HTTP headers.
%…b: Bytes sent, excluding HTTP headers. In CLF format
i.e. a ‘-‘ rather than a 0 when no bytes are sent.

%…{FOO}e: The contents of the environment variable FOO
%…f: Filename
%…h: Remote host
%…H The request protocol
%…{Foo}i: The contents of Foo: header line(s) in the request
sent to the server.
%…l: Remote logname (from identd, if supplied)
%…m The request method
%…{Foo}n: The contents of note “Foo” from another module.
%…{Foo}o: The contents of Foo: header line(s) in the reply.
%…p: The canonical Port of the server serving the request
%…P: The process ID of the child that serviced the request.
%…q The query string (prepended with a ? if a query string exists,
otherwise an empty string)
%…r: First line of request
%…s: Status. For requests that got internally redirected, this is
the status of the *original* request — %…>s for the last.
%…t: Time, in common log format time format (standard english format)
%…{format}t: The time, in the form given by format, which should
be in strftime(3) format. (potentially localised)
%…T: The time taken to serve the request, in seconds.
%…u: Remote user (from auth; may be bogus if return status (%s) is 401)
%…U: The URL path requested.
%…v: The canonical ServerName of the server serving the request.
%…V: The server name according to the UseCanonicalName setting.

In each case, the “…” indicates an (optional) condition. If the condition is met, then the particular. If the condition is omitted, then the variable will be replaced with a “-” if it is not defined.

Example

LogFormat “%h %l %u %U %v %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”” combined
LogFormat “%h %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”” common

# You need to enable mod_logio.c to use %I and %O
LogFormat “%h %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\” %I %O” combinedio

CustomLog logs/access_log “common”