Apache logs

Last Updated: Jul 07, 2017

The Apache log format and directory are specified in the /etc/apache2/httpd.conf configuration file.

Log format

  1. LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
  2. LogFormat "%h %l %u %t \"%r\" %>s %b" common

The above statements define two log formats: combined and common.

The following statement writes logs into the specified file in the combined format.

  1. CustomLog "/var/log/apache2/access_log" combined

Sample log:

  1. 192.168.1.2 - - [02/Feb/2016:17:44:13 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "http://localhost/x1.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.97 Safari/537.36"

Apache log format details:

  1. %a remote_ip
  2. %A local_ip
  3. %B size
  4. %b size
  5. %D time_taken_ms
  6. %f filename
  7. %h remote_host
  8. %H protocol
  9. %l ident
  10. %m method
  11. %p port
  12. %P pid
  13. "%q" url_query
  14. "%r" request
  15. %s status
  16. %>s status
  17. %t time
  18. %T time_taken
  19. %u remote_user
  20. %U url_stem
  21. %v server_name
  22. %V canonical_name
  23. %I bytes_received
  24. %O bytes_sent
  25. "%{User-Agent}i" user_agent
  26. "%{Referer}i" referer

Apache log collection by Log Service

For details about the standard process, refer to Quick start. Manually edit the regular expression after it is automatically generated.

1

After all fields are extracted, set the name of each field and adjust the regular expression for general applicability.

Click Manual Input Regular Expression to adjust as follows.

2

The length field is numeric, but can be filled in with a hyphen. In this case, replace the matched result (\d+) with (\S+). If other fields do not belong to the defined type, make similar replacements.

After replacing, click Validate. If the regular expression is correct, extracted results are displayed. Manually adjust the regular expression if it is incorrect.

3

Assign a defined field to each extracted result. For example, name a field “time”. Click Auto Generate next to Time Format. Then click Next.

After Logtail configuration is completed, push the configuration to the client.

Thank you! We've received your feedback.