Custom Log Formats
The format argument to the LogFormat and CustomLog directives is a string. This string is used to log each request to the log file. It can contain literal characters copied into the log files and the C-style control characters “\n” and “\t” to represent new-lines and tabs. Literal quotes and back-slashes should be escaped with back-slashes.
The characteristics of the request itself are logged by placing “%” directives in the format string, which are replaced in the log entry by the values as follows:
%...a: Remote IP-address
%...A: Local IP-address
%...B: Bytes sent, excluding HTTP headers.
%...b: Bytes sent, excluding HTTP headers. In CLF format
i.e. a '-' rather than a 0 when no bytes are sent.
%...c: Connection status when response was completed.
'X' = connection aborted before the response completed.
'+' = connection may be kept alive after the response is sent.
'-' = connection will be closed after the response is sent.
%...{FOOBAR}e: The contents of the environment variable FOOBAR
%...f: Filename
%...h: Remote host
%...H The request protocol
%...{Foobar}i: The contents of Foobar: header line(s) in the request
sent to the server.
%...l: Remote logname (from identd, if supplied)
%...m The request method
%...{Foobar}n: The contents of note "Foobar" from another module.
%...{Foobar}o: The contents of Foobar: header line(s) in the reply.
%...p: The canonical Port of the server serving the request
%...P: The process ID of the child that serviced the request.
%...q The query string (prepended with a ? if a query string exists,
otherwise an empty string)
%...r: First line of request
%...s: Status. For requests that got internally redirected, this is
the status of the *original* request --- %...>s for the last.
%...t: Time, in common log format time format (standard english format)
%...{format}t: The time, in the form given by format, which should
be in strftime(3) format. (potentially localized)
%...T: The time taken to serve the request, in seconds.
%...u: Remote user (from auth; may be bogus if return status (%s) is 401)
%...U: The URL path requested, not including any query string.
%...v: The canonical ServerName of the server serving the request.
%...V: The server name according to the UseCanonicalName setting.
The “...” can be nothing at all (e.g., "%h %u %r %s %b"), or it can indicate conditions for inclusion of the item (which will cause it to be replaced with “-” if the condition is not met). The forms of condition are a list of HTTP status codes, which may or may not be preceded by “!”. Thus, “%400,501{User-agent}i” logs User-agent: on 400 errors and 501 errors (Bad Request, Not Implemented) only; “%!200,304,302{Referer}i” logs Referer: on all requests which did not return some sort of normal status.
Note that in versions previous to 1.3.25 no escaping was performed on the strings from No value assigned...i and %...o. This was mainly to comply with the requirements of the Common Log Format. This implied that clients could insert control characters into the log, so you had to be quite careful when dealing with raw log files.
For security reasons starting with 1.3.25 non-printable and other special characters are escaped mostly by using \xhh sequences, where hh stands for the hexadecimal representation of the raw byte. Exceptions from this rule are " and \ which are escaped by prepending a backslash, and all whitespace characters that are written in their C-style notation (\n, \t, etc).
Some commonly used log format strings are:
- Common Log Format (CLF)
"%h %l %u %t \"%r\" %>s %b"- Common Log Format with Virtual Host
"%v %h %l %u %t \"%r\" %>s %b"- NCSA extended/combined log format
"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""- Referer log format
"%{Referer}i -> %U"- Agent (Browser) log format
"%{User-agent}i"
Note that the canonical ServerName and Port of the server serving the request are used for No value assignedp respectively. This happens regardless of the UseCanonicalName setting because otherwise log analysis programs would have to duplicate the entire vhost matching algorithm in order to decide what host really served the request.