Apache Server access log access.log settings

One, access log information

When the browser requests the server, if the access log is set on the server, the user's access record is logged.

For example, I access a default log generated by the local Apache:

127.0.0.1--[03/feb/2015:23:14:24 +0800] "get/http/1.1" 200 2

Divided into 7 parts

(1) The first information is the address of the remote host, which indicates who is visiting the site. (Apache can be asked to identify all host names and replace the IP address with the host name in the log file, but this practice can greatly affect the speed of logging the server, thereby reducing the efficiency of the entire site, not recommended). However, if it is really necessary to make APAC
E to find the name of the remote host, you can use the following command:

Hostnamelookups on

If Hostnamelookups is set to double instead of on, the logger will reverse-lookup the host name it finds, verifying that the host name does point to the IP address that originally appeared.

(2) The second entry in the previous example log is blank and replaced with a "-" placeholder. In fact, most of the time this is the case. This location is used to record the browser's identity, not just the user's login name, but the email address or other unique identifier of the person who browsed the browser. This information is returned by Identd, or directly by the browser. (To avoid spam harassment of users ' mailboxes, the second item is replaced with "-").

(3) The third item in the diary is also blank. This location is used to record the name provided by the browser when authenticating. Of course, if some content of the site requires users to authenticate, then this information room will not be blank. However, for most Web sites, this entry in most records of a log file is still blank.

(4) The fourth item of the log record is the time of the request. This information is enclosed in square brackets and is in "Common log format" or "Standard English format". Therefore, the last "0400" of the time information indicates that the server's time zone is 4 hours before UTC.

(5) The fifth message of the log may be the most useful information in the entire log record, which tells us what kind of request the server is subjected to. The typical format for this information is "method RESOURCE PROTOCOL", or "approach Resource Protocol" (which we usually look at when logging is monitored). The example method is get, as well as post, head and other types, mainly these three kinds.

Resource refers to the document or URL that the browser requests to the server. In this example, the browser asks for "/", which is the root or homepage of the website. In most cases, "/" points to the index.html document of the DocumentRoot directory, but may also point to other files depending on the server configuration.

The protocol is usually HTTP, followed by the version number.

(6) The sixth Information Room status code of the log. It tells us whether the request was successful or what kind of error was encountered. Most of the time this is 200, which indicates that the server has successfully responded to browser requests and everything is OK. (A status code that starts with 2 indicates success, a status code starting with 3 indicates that the user request was redirected to a different location due to various reasons, the status codes starting with 4 indicate that the client has some kind of error, and the status codes starting with 5 indicate that the server encountered an error).

(7) The seventh entry in the log record indicates the total number of bytes sent to the client. It tells us if the transmission is interrupted (that is, if the value is the same size as the file)

Second, configure the access log

In Apache configuration file httpd.conf, one line is configured as follows:

Customlog "Logs/access.log" common

Specifies the directory path for the log./logs/, specifies the format of the log, the default common.

The common format is defined by: Logformat "%h%l%u%t \"%r\ "%>s%b" common.

The format string inside the double quotation marks represents the specific information.

Apache format strings and their meanings:

<span style= "FONT-SIZE:18PX;" >%%     percent semicolon (Apache2.0.44 or higher)%a     remote IP address%a     native IP address%b      Bytes Transmitted in addition to the HTTP header%b     The number of bytes transmitted in CLF format other than the HTTP header, that is, '-' instead of 0 when there is no byte transfer. %{foobar}c     The content of the Cookiefoobar in the request to the server. %d     The time that the server takes to process this request, in micro-units. %{foobar}e     environment variable FOOBAR value%f     file name%h     remote host%h     The request uses the protocol%{foobar}i     sends the content to the server's request header Foobar:. %l     Remote Login name (from Identd, if supported), unless IdentityCheck is set to "on", you will get a "-". %m     Request Method%{foobar}n     The contents of the annotation Foobar from another module. %{foobar}o     Answer header Foobar: the content. The%p     Server serves the standard port of the request. %p     PID of a subprocess that serves this request. The%{format}p serves the PID or TID (thread ID) of the request, and the format value range is: PID and Tid (2.0.46 and later) and Hextid (requires APR1.2.0 and above)%q     The query string, if present, by a "?" Boot, otherwise return empty string)%r     The first line of the request%s     status. For internal redirection requests, this state refers to the state of the original request,---%>s refers to the last requestThe state. %t     time, in normal log time format (Standard English format)%{format}t     time, in the format specified by Strftime (3) for the time indicated. (localized format by default)%t   the time, in seconds, that the request takes to be processed   completed. %u     Remote User name (based on authentication information, if return status (%s) is 401, may be false)%u     requested URL path, does not contain a query string. %v     standard servername for service of this request. %v     Server name according to the Usecanonicalname directive. </span><span style= "FONT-SIZE:18PX;" > Supplemental < and > modifiers can be used to specify whether the request that has been internally redirected is to select the original request or to select the final request. By default,%s, %u, %t, %d, %r  uses the original request, and all other format strings select the final request. For example,,<strong>%>s</strong>  can be used to record the final state of a request, while  %<u  records an original authenticated user who has been internally redirected to a request for a non-certified resource.    If you put one or more HTTP status codes between "%" and a variable, the content represented by the variable is recorded only if the status code returned by the request belongs to one of the specified status codes. For example, if we want to record all invalid links for a site, then you can use:       logformat %404{referer}i  brokenlinks     Conversely, if we want to record the request that the status code does not equal the specified value, simply add a "!" Symbols can be:    logformat %!200u somethingwrong   </span>

We can also customize the log format, for example:

Logformat "%h%l%u%t \"%r\ "%>s%b \"%{referer}i\ "\"%{user-agent}i\ "" combine

Defines the combine format where \ "%{referer}i\" \ "%{user-agent}i\" is the pleading header and Referer link sent to the server.

Apache Server access log access.log settings