Apache | Log Files | Recording Specific Logs in Another File

Tags:

Access logs do not have to be stored in only one file. You can define multiple log formats and store them in separate access log files.

Add a format that records only User-Agent to the log formats written in httpd.conf by default.

LogFormat "%{User-Agent}i" agent

Then specify a new CustomLog in the log file settings.

CustomLog logs/agent.log agent

The actual configuration would look like the following.

<IfModule log_config_module>
    #
    # The following directives define some format nicknames for use with
    # a CustomLog directive (see below).
    #
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    LogFormat "%{User-Agent}i" agent <--------------------------- 여기 추가하였다.

    <IfModule logio_module>
      # You need to enable mod_logio.c to use %I and %O
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>

    #
    # The location and format of the access logfile (Common Logfile Format).
    # If you do not define any access logfiles within a <VirtualHost>
    # container, they will be logged here.  Contrariwise, if you *do*
    # define per-<VirtualHost> access logfiles, transactions will be
    # logged therein and *not* in this file.
    #
    #CustomLog "logs/access.log" common

    #
    # If you prefer a logfile with access, agent, and referer information
    # (Combined Logfile Format) you can use the following directive.
    #
    #CustomLog "logs/access.log" combined
		
    CustomLog logs/agent.log agent <--------------------------- 여기 추가하였다.
		
</IfModule>

Now only User-Agent is recorded in a separate access log file named agent.log.

After editing httpd.conf, restart Apache, access Apache a few times, and check the logs.

Separate from the existing access.log file that recorded access logs, a new file named agent.log is created. You can confirm that it contains only information about the browser that accessed the file.

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18363

The log above is from viewing HTML files published by Apache in three browsers: Internet Explorer, Edge, and Chrome.