Understanding the Apache access logs

A new Apache install implements several different access log file entry formats, all of which are specified in apache.conf. This is shown in Figure 5.2:

Figure 5.2 – Apache access log file entry format definitions

As shown in Figure 5.2, each format is defined using format strings. Let’s take a closer look at the combined format, as this is the default in most installations. Here is the entry from apache.conf for the combined format in detail:

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

An explanation of each of the format strings used in the combined format is given in Figure 5.3. For a full list of available format strings, see https://httpd.apache.org/docs/2.4/mod/mod_log_config.html#customlog:

Figure 5.3 – Explanation of the format strings that are used in a combined format log entry...