Apache | Log Files | Access Log Format (LogFormat)

Log format: LogFormat

The log format is specified with LogFormat. The syntax is as follows.

LogFormat "format" log-format-name

By default, the following two log formats are defined in the httpd.conf file.

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common

There are two log format names: common and combined. The format is defined by combining multiple items. The main configurable items are as follows.

Setting	Meaning
%a	Accessing IP address
%A	Server (Apache) IP address
%B	Number of bytes transferred, excluding headers
%b	Number of bytes transferred, excluding headers; `-` is displayed for 0 bytes
%f	Requested file name
%h	Remote host name
%H	Request protocol name
%l	Client identifier
%m	Request method name
%q	Query string included in the request; `?` is added unless it is empty
%r	Value of the first request line
%s	Response status
%>S	Status of the final response
%t	Time
%T	Time taken to process
%u	Authenticated user name
%U	URL path of the request
%v	Virtual host name for the request
%V	Server name according to UseCanonicalName
%X	Connection status
%{cookie-name}C	Cookie value included in the request
%{environment-variable}e	Value of the environment variable
%{header-name}i	Header value included in the request
%{header-name}o	Header value included in the response
%{note}n	Value of a note returned by a module
%{format}t	Formatted time

List these items and wrap them in double quotes ("). If you write double quotes inside the format, escape them with a backslash (\).

Some items are written inside braces ({}). For example, %{header-name}i records the value specified by that header name from the request headers. If %{User-Agent}i is specified, it records the User-Agent value from the header.

Testing an access log format change

The access log enabled by default is common. Change it to the other prepared format, combined. In the httpd.conf file, you will find a section like the following.

    #
    # The location and format of the access logfile (Common Logfile Format).
    # If you do not define any access logfiles within a <VirtualHost>
    # container, they will be logged here.  Contrariwise, if you *do*
    # define per-<VirtualHost> access logfiles, transactions will be
    # logged therein and *not* in this file.
    #
    CustomLog "logs/access.log" common

    #
    # If you prefer a logfile with access, agent, and referer information
    # (Combined Logfile Format) you can use the following directive.
    #
    #CustomLog "logs/access.log" combined

Add # before CustomLog logs/access.log common, and remove the # before CustomLog logs/access.log combined.

    #
    # The location and format of the access logfile (Common Logfile Format).
    # If you do not define any access logfiles within a <VirtualHost>
    # container, they will be logged here.  Contrariwise, if you *do*
    # define per-<VirtualHost> access logfiles, transactions will be
    # logged therein and *not* in this file.
    #
    #CustomLog "logs/access.log" common

    #
    # If you prefer a logfile with access, agent, and referer information
    # (Combined Logfile Format) you can use the following directive.
    #
    CustomLog "logs/access.log" combined

Now the access log can be stored in the format defined with the name combined. Restart Apache, access Apache a few times, and check the access log.

::1 - - [06/Dec/2019:00:48:42 +0900] "GET /admin/admin.html HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
127.0.0.1 - - [06/Dec/2019:00:49:03 +0900] "GET / HTTP/1.1" 200 46 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
127.0.0.1 - - [06/Dec/2019:00:49:03 +0900] "GET /favicon.ico HTTP/1.1" 404 196 "http://127.0.0.1/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
127.0.0.1 - - [06/Dec/2019:00:49:24 +0900] "GET /phpinfo HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
127.0.0.1 - - [06/Dec/2019:00:49:34 +0900] "GET /phpinfo.php HTTP/1.1" 200 72966 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

The content above is a log recorded in the new format. You can see that more detailed information is recorded.