Apche Log Series (3): Custom logs

Sometimes we need to customize the format and content of Apache default logs, such as adding or reducing the information recorded in logs and changing the format of default log files. This article describes all the information that can be recorded using logs and how to set Apache to record the information.

1. Define the log format (January 1, April 3)

A long time ago, there was only one log file format, which was a "public format" and many people were used to this format. The custom log format appeared later, and it seems that the custom log format is more popular, even though the public log format itself is also redefined in the custom log format. This article describes how to customize the log file format and how to make the log file record the desired information as needed.

The format of the custom log file involves two commands, namely the logformat command and the customlog command. By default, the httpd. conf file provides several examples of these two commands.

The logformat command defines the format and specifies a name for the format. Then we can directly reference this name. The customlog command sets the log file and specifies the format used by the log file (usually by the format name ).

The function of the logformat command is to define the log format and specify a name for it. For example, in the default httpd. conf file, we can find the following line of code:

Logformat "% H % L % u % t/" % R/"%> S % B" common

This command creates a log format named "common". The log format is specified in the content enclosed by double quotation marks. Each variable in the format string represents a specific information, which is written to the log file in the order specified by the format string.

The Apache document has provided all the variables that can be used for format strings and their meanings:

----------------------------------------------------------------------

%... A: remote IP Address

%... A: local IP Address

%... B: Number of sent bytes, excluding the HTTP Header

%... B: Number of sent bytes in CLF format, excluding the HTTP header.

For example, if no data is sent, write '-' instead of 0.

%... {Foobar} e: content of the Environment Variable foobar

%... F: File Name

%... H: Remote Host

Protocol for %... h request

%... {Foobar} I: content of foobar, the header line of the request sent to the server.

%... L: Remote Login Name (from identd, if provided)

%... M Request Method

%... {Foobar} n: content of the annotation "foobar" from another module

%... {Foobar} O: foobar content, response header line

%... P: port used by the server to respond to the request

%... P: the ID of the child process that responds to the request.

%... Q query string (if a query string exists, it contains "?" The

Otherwise, it is an empty string .)

%... R: the first line of the request

%... S: status. For internal redirection requests, this refers to * original * requests

. If %...> S is used, it indicates a later request.

%... T: Time in the public log time format (or standard English format)

%... {Format} t: Time in the specified format

%... T: time spent in responding to the request, in seconds

%... U: remote user (from auth; if the returned status (% s) is 401, it may be forged)

%... U: URL path requested by the user

%... V: servername of the server responding to the request

%... V: name of the server set according to UseCanonicalName

------------------------------------------------------------------

Among all the variables listed above, "..." indicates an optional condition. If no condition is specified, the value of the variable is replaced. The default httpd is used before the analysis. the example of the logformat command in the conf file shows that it creates a log format named "common", including: remote host, remote login name, remote user, request time, the first line of the Request Code, the Request status, and the number of bytes sent.

Sometimes we only want to record some specific and defined information in the log, then we need to use "...". If one or more HTTP status codes are put between "%" and the variable, only when the status code returned by the request belongs to the specified status code, the content represented by the variable is recorded. For example, if you want to record all invalid links of a website, you can use:

----------------------------------------------------

Logformat % 404 {Referer} I brokenlinks

---------------------------------------------------

If we want to record requests whose status code is not equal to the specified value, we only need to add a "!" Symbol:

Logformat %! 200u somethingwrong