Apache server access log access. log Settings

Apache server access log access. log Settings
1. access log information

When the browser requests the server, if access logs are set on the server, the user's access records are recorded.

For example, a default log generated when I access local apache:

127.0.0.1--[03/Feb/2015: 23: 14: 24 + 0800] "GET/HTTP/1.1" 200 2

Divided into seven parts

(1) The first information is the address of the remote host, that is, it indicates who is accessing the website. (Apache can be required to identify all host names and replace the IP address with the host name in the log file. However, this method will greatly affect the log record speed of the server, this reduces the efficiency of the entire website and is not recommended ). However, if it is necessary to make Apac
E. Run the following command to find the remote host name:

HostNameLookups on

If HostNameLookups is set to double instead of on, the logging program will reverse query the host name it finds to verify that the host name actually points to the original IP address.

(2) the second item of the log record in the above example is blank and replaced by a "-" placeholder. In fact, this is the case most of the time. This location is used to record the visitor's identity. It is not just the visitor's login name, but the viewer's email address or other unique identifier. This information is returned by identd, or directly by the browser. (In order to avoid spam harassment of users' mailboxes, the second option is replaced ).

(3) The third item of the diary record is blank. This location is used to record the name provided by the viewer for identity authentication. Of course, this information room will not be blank if users are required to perform authentication on some content of the website. However, for most websites, this field is still blank in most records of log files.

(4) The fourth log record is the request time. This information is enclosed in square brackets and in "Public log format" or "Standard English format ". Therefore, the last "-0400" in the time information indicates that the server is located four hours earlier than UTC.

(5) the fifth item of log record may be the most useful information in the entire log record. It tells us what kind of request the server receives. The typical format of this information is "method resource protocol", that is, "method resource protocol" (This content is mainly used for log monitoring ). In this example, the METHOD is GET, and there are other types such as POST and HEAD, mainly these three types.

RESOURCE refers to the document or URL requested by the browser to the server. In this example, the visitor requests "/", that is, the root or homepage of the website. In most cases, "/users refer to the index.html document of the documentrootdirectory, but may also point to other files based on different server configurations.

The PROTOCOL is usually HTTP, followed by the version number.

(6) The sixth Information Room status code of the log. It tells us whether the request is successful or what kind of error is encountered. Most of the time this is 200, it indicates that the server has successfully responded to the browser request, everything is normal. (Status codes starting with 2 indicate success. Status codes starting with 3 indicate that user requests are redirected to other locations for different reasons, status Code starting with 4 indicates that the client has an error. Status Code starting with 5 indicates that the server has encountered an error ).

(7) The seventh log record indicates the total number of bytes sent to the client. It indicates whether the transmission is interrupted (that is, whether the value is the same as the file size)

2. configure access logs

In the apache configuration file httpd. conf, one line is configured as follows:

CustomLog "logs/access. log" common

Specifies the log directory path./logs/, and specifies the log format. The default value is common.

The common format is defined by: LogFormat "% h % l % u % t \" % r \ "%> s % B" common.

The format string in double quotation marks indicates specific information.

Apache format string and its meaning:

<Span style = "font-size: 18px;"> % percent (Apache2.0.44 or later) % a remote IP address % A local IP address % B bytes transferred except the HTTP header % B number of bytes transmitted in addition to the HTTP header in CLF format, that is, when no Bytes are transferred, '-' is displayed instead of 0. The content of cookieFoobar that % {Foobar} C sends to the server in the request. % D the time used by the server to process this request, in microseconds. % {FOOBAR} e environment variable FOOBAR Value % f file name % h remote host % H request uses protocol % {Foobar} I to the server's request header Foobar: content. % L remote login name (provided by identd, if supported), a "-" will be obtained unless IdentityCheck is set to "On "-". The % m request method % {Foobar} n comes from the annotation Foobar content of another module. % {Foobar} o Response Header Foobar: content. % P server serves the standard port of the request. % P is the PID of the subprocess that serves the request. % {Format} P serves the PID or TID (thread ID) of the request. The value range of format is pid and tid (2.0.46 and later versions) and hextid (APR1.2.0 or a later version is required) % q query string (If yes, "? "Boot; otherwise, an empty string is returned.) % r indicates the status of the first row of the Request % s. For internal redirection requests, this status refers to the status of the original request, and --- %> s refers to the status of the final request. % T time, expressed in common log time format (Standard English format) % {format} t time, in the format specified by strftime (3. (In the local format by default) % T the time taken to process the request, in seconds. % U remote user name (based on verification information; if the returned status (% s) is 401, it may be false) % U request URL path, does not contain the query string. % V standard ServerName that provides services for this request. % V indicates the server name set according to the UseCanonicalName command. </Span> <span style = "font-size: 18px; "> [Supplement]" <"and"> "modifiers can be used to specify whether to select the original request or the final request for a request that has been internally redirected. By default, % s, % U, % T, % D, % r use the original request, and all other format strings select the final request. For example, <strong> %> s </strong> can be used to record the final state of the request, % <u records an original authenticated user who has been internally redirected to a non-authenticated resource. If one or more HTTP status codes are put between "%" and the variable, only when the status code returned by the request belongs to the specified status code, the content represented by the variable is recorded. For example, if you want to record all invalid links of a website, you can use: LogFormat % 404 {Referer} I BrokenLinks. Otherwise, if we want to record requests whose status code is not equal to the specified value, we only need to add a "!" Symbol: LogFormat %! 200U SomethingWrong </span>

You can also customize the log format, for example:

LogFormat "% h % l % u % t \" % r \ "%> s % B \" % {Referer} I \ "\" % {User-Agent} I \ "" combine

The combine format is defined. \ "% {Referer} I \" \ "% {User-Agent} I \" is the request header sent to the server and the Referer link.