LogFormat parameters of apache logs

The LogFormat parameter of apache logs is described in the apache configuration file httpd. by default, logformat "% h % l % u % t \" % r \ "%> s % B \" % {Referer} I \ "is configured in conf \"\" % {User-Agent} I \ "" common this is APACHE log record format settings, what do the parameters in this format mean? The following describes the specific parameters: the request itself will be recorded by placing various "%" escape characters in the format string. When they are written to the log file, they are converted according to the definition in the following table: % a remote IP address % A local IP address % B bytes transferred except the HTTP header % B number of bytes transmitted in addition to the HTTP header in CLF format, that is, when no Bytes are transferred, '-' is displayed instead of 0. The content of cookieFoobar that % {Foobar} C sends to the server in the request. % D the time used by the server to process this request, in microseconds. % {FOOBAR} e environment variable FOOBAR Value % f file name % h remote host % H request uses protocol % {Foobar} I to the server's request header Foobar: content. % L remote login name (provided by identd, if supported), a "-" will be obtained unless IdentityCheck is set to "On "-". The % m request method % {Foobar} n comes from the annotation Foobar content of another module. % {Foobar} o Response Header Foobar: content. % P server serves the standard port of the request. % P is the PID of the subprocess that serves the request. % {Format} P serves the PID or TID (thread ID) of the request. The value range of format is pid and tid (2.0.46 and later versions) and hextid (APR1.2.0 or a later version is required) % q query string (If yes, "? "Boot; otherwise, an empty string is returned.) % r indicates the status of the first row of the Request % s. For internal redirection requests, this status refers to the status of the original request, and-%> s refers to the status of the final request. % T time, expressed in common log time format (Standard English format) % {format} t time, in the format specified by strftime (3. (In the local format by default) % T the time taken to process the request, in seconds. % U remote user name (based on verification information; if the returned status (% s) is 401, it may be false) % U request URL path, does not contain the query string. % V standard ServerName that provides services for this request. % V indicates the server name set according to the UseCanonicalName command. % X connection status when the request is completed: X = the connection is interrupted before the response is completed. + = Keep the connection after the response is sent. -= Close the connection after the response is sent. (In Versions later than 1.3, this command is % c, but this is in conflict with the previous SSL Syntax: % {var} c) % I received the number of bytes, data that includes the request header cannot be zero. To use this command, you must enable the mod_logio module. The number of bytes sent by % O, including the data in the request header, and cannot be zero. To use this command, you must enable the mod_logio module. The modifier can be followed by a comma-separated list of status codes next to "%" to restrict record entries. For example, "% 400,501 {User-agent} I" only records the User-agent header content when status code 400 and 501 occur. If the conditions are not met, use "-" instead. You can add "! "Prefix indicates no," %! 200,304,302 {Referer} I "records all the Referer header content different from the status code 200,304,302 when it occurs. "<" And ">" modifiers can be used to specify whether to select the original request or the final request for a request that has been internally redirected. By default, % s, % U, % T, % D, % r use the original request, and all other format strings select the final request. For example, %> s can be used to record the final state of the request, while % <u records the original authenticated user of a request internally redirected to a non-authenticated resource. For security reasons, special characters in % r, % I, and % o, except double quotation marks (") and backslash (\) escape with \ "and \, and escape with C style (\ n, \ t, etc, escape non-printable characters and other special characters in \ xhh format (hh is the hexadecimal encoding of this character ). In versions earlier than 2.0.46, the content is fully recorded as is. This will allow the client to insert control characters in the log, so you must be especially careful when processing these log files. In version 2.0 (different from 1.3), strings in the format of % B and % B do not indicate the number of bytes sent to the client, it simply represents the number of HTTP response bytes (different from the former when the connection is interrupted or SSL is used ). The % O string provided by mod_logio records the actual number of bytes sent. Examples of common format strings: Common log format (CLF) "% h % l % u % t \" % r \ "%> s % B" General log format with VM "% v % h % l % u % t \ "% r \" %> s % B "NCSA extended/combined log format" % h % l % u % t \ "% r \" %> s % B \ "% {Referer} I \ "\" % {User-agent} I \ "" Referer log format "% {Referer} I-> % U" Agent (Browser) logFormat "% h % l % u % t \" % r \ "%> s % B \" % {referer} I \ "\" % {User-Agent} I \ "" common intermediate "" can be found in the above descriptions for parameters, the last common is actually an identifier in this format. When you apply this format to record logs, you can directly use the identifier, for example: customLog logs/access_log common generates a log file access_log in the common format under logs.