Apache Log Configuration Parameters detailed description

Apache logs by Time-phased recording
Found in Apache configuration file httpd.conf
Errorlog Logs/error_log and Customlog Logs/access_log common
Linux System Configuration Method:
Change it to
Errorlog "| /usr/local/apache/bin/rotatelogs/home/logs/www/%y_%m_%d_error_log 86400 480″
Customlog "| /usr/local/apache/bin/rotatelogs/home/logs/www/%y_%m_%d_access_log 86400 480″common
Configuration method under Windows system:
Errorlog "|bin/rotatelogs.exe logs/site1/error-%y%m%d.log 86400 480″
Customlog "|bin/rotatelogs.exe logs/site1/access-%y%m%d.log 86400 480″common
Where common is the name set in the log record format.
If you have more than one site, you should write the above configuration to the VirtualHost node in each site, so that each site log is recorded separately.
Attached rotatelogs Instructions
Rotatelogs logfile [rotationtime [offset]] | [Filesizem]
Options
LogFile
It adds the base name to the log file name. If the logfile contains '% ', then it is treated as a format string for the strftime (3); otherwise, it is automatically appended with the. nnnnnnnnnn suffix in seconds. Both formats represent the time when the new log began to be used.
Rotationtime
The interval in seconds for the log file to be rolled back, and 86400 for one day, a new log file is generated daily.
Offset
The number of minutes of the time difference relative to UTC. If omitted, the default is 0, and UTC time is used. For example, to specify local time for a region with a UTC time difference of 5 hours, this parameter should be-300, Beijing is +8 time, and should be set to 480. In this way, the time in the log is consistent with the time on the server, which makes it easy to view logs.
Filesizem
Specifies the file size of the suffix letter M in megabytes when the volume is returned, instead of specifying the rollback time or the slack.

settings for Apache logging format
The format of the custom log file involves two instructions, the Logformat directive and the Customlog directive, and the default httpd.conf file provides several examples of these two instructions.
The LOGFORMAT directive defines the format and assigns a name to the format, and we can refer to that name directly later. The customlog instruction sets the log file and indicates the format in which the log file is used (usually by the name of the format).
The function of the Logformat directive is to define the log format and assign it a name. For example, in the default httpd.conf file, we can find the following line of code:
Logformat "%h%l%u%t \"%r\ "%>s%b" common
This directive creates a log format called "Common", which is specified in the text surrounded by double quotes. Each variable in the format string represents a specific piece of information that is written to the log file in the order specified by the format sequence.
The Apache documentation has given you all the variables that are available for the format string and their meanings, as follows:
%...A: Remote IP Address
%... A: Local IP address
%... B: Number of bytes sent, not including HTTP headers
The number of bytes sent in the%...B:CLF format, with no HTTP headers. For example, when no data is sent, write '-' instead of 0.
%... {foobar}e: Contents of environment variable FOOBAR
%...F: File name
%...H: Remote Host
%... H the requested protocol
%... {Foobar}i:foobar content, the header line of the request sent to the server.
%...L: Telnet name (from Identd, if provided)
%...m method of Request
%... {foobar}n: The contents of the annotation "Foobar" from another module
%... {Foobar}o:foobar content, header line of the reply
%...P: The port used by the server in response to a request
%... P: The child process ID of the response request.
%...Q query string (if there is a query string, contains "?" The following part; otherwise, it is an empty string. ）
%...R: First line of the request
%...S: status. For internal redirection requests, this refers to the status of the original * request. If you use%...>s, you refer to a later request.
%...T: Time in Public log time format (or Standard English format)
%... {format}t: The time represented in the specified format
%... T: The amount of time spent in response to a request, in seconds
%...U: Remote user (from Auth; if the return status (%s) is 401 it may be forged)
%... U: URL path requested by the user
%...V: servername of the server responding to the request
%... V: Server name according to Usecanonicalname settings

In all the variables listed above, "..." represents an optional condition. If no condition is specified, the value of the variable is replaced with "-". Analyzing the example of the logformat instruction from the default httpd.conf file earlier, you can see that it creates a log format called "Common", which includes: remote host, Telnet name, remote user, request time, first line of request, request status, and number of bytes sent.
Sometimes we just want to record some specific, defined information in the log, and then we need to use "...". If you put one or more HTTP status codes between "%" and a variable, the content represented by the variable is logged only if the status code returned by the request belongs to one of the specified status codes. For example, if we want to record all the invalid links for a site, you can use:
Logformat%404{referer}i Brokenlinks
Conversely, if we want to record the request that the status code does not equal the specified value, simply add a "!" Symbols can:
Logformat%!200u Somethingwrong

specifically documenting a spider record .
Setenvifnocase user-agent Baiduspider Baidu_robot
Logformat "%h%t \"%r\ "%>s%b" robot
Linux under
Customlog "|/usr/local/apache2.2.0/bin/rotatelogs/usr/local/apache2.2.0/logs/baidu_%y%m%d.txt 86400 480″robot env= Baidu_robot
Windows under
Customlog "|bin/rotatelogs.exe logs/baidu_%y%m%d.txt 86400 480″robot Env=baidu_robot
In this case, in the logs directory, will be generated every day, Baidu_ day. txt log, each record and the following similar:
61.135.168.14 [22/oct/2008:22:21:26 +0800] "get/http/1.1″200 8427

remove pictures, js, CSS, swf files from the log
<filesmatch "\. (ICO|GIF|JPG|PNG|BMP|SWF|CSS|JS) ">
SETENV IMAG 1
</FilesMatch>
Customlog "|bin/cronolog.exe logs/cpseadmin/access_%y%m%d.log" combined env=! IMAG

Something: As for why to add the log, when you are attacked malicious access, can quickly locate to which site, tragic I gave people attack, the key is I did not add log, almost, 2 hours 60G traffic No!!!!

Apache Log Configuration Parameters detailed description