Apache server access log access Log settings

One 、 Access log information

When the browser requests The server when , If in The server Access logs are set on , The user's access records will be recorded .

For example, I visit local apache A default log generated ：

127.0.0.1 - - [03/Feb/2015:23:14:24 +0800] "GET / HTTP/1.1" 200 2

It is divided into 7 Parts of

（1） The first information is the address of the remote host , That is, it shows who is visiting the website .（ You can ask for apache Find out all the host names , And use the host name in the log file to replace ＩＰ Address , But this practice will have a great impact The server The speed of logging , Thus reducing the efficiency of the entire website , It's not worth recommending ）. However , If it is really necessary to let Ａｐａｃ

ｅ Find the name of the remote host , You can use the following instructions ：

HostNameLookups on

If HostNameLookups Set to double instead of on, The logger will reverse the hostname it finds , Verify that the host name does point to the original IP Address .

（2） The second item of the log record in the above example is blank , Use one “-” Placeholder replacement . In fact, this is the case most of the time . This location is used to record the identity of the browser , This is not just the login name of the browser , It's the browser's email Address or other unique identifier . This information is provided by identd return , Or return directly from the browser .（ In order to avoid users' mailbox being harassed by spam , The second is to use “-” To replace the ）.

（3） The third item in the diary is also blank . This location is used to record the name provided by the browser when authenticating . Of course , If some content of the website requires users to authenticate , Then this information room will not be empty . however , For most websites , This item is still blank in most records of the log file .

（4） The fourth item of logging is the requested time . This information is enclosed in square brackets , And “ Common log format ” perhaps “ Standard English format ”. therefore , Time information last “-0400” Indicates that the time zone of the server is in UTC Previous 4 Hours .

（5） The fifth information recorded in the log is probably the most useful information in the whole log , It tells us what kind of request the server receives . The typical format of this information is “METHOD RESOURCE PROTOCOL” namely “ Method resources agreement ”（ We usually monitor logs , It's mainly about this content ）. In the example METHOD yes GET, also POST、HEAD Other types , Mainly these three .

RESOURCE It refers to the document or ＵＲＬ. In this case , What the browser requests is “／”, That is, the root or home page of the website . Most of the time ,“／” Point to DocumentRoot The directory index.html file , However, depending on the server configuration, it may also point to other files .

PROTOCOL Usually HTTP, Then add the version number .

（6） The sixth information room status code of the log . It tells us whether the request was successful , Or what kind of mistakes have you made . Most of the time this item is 200, It indicates that the server has successfully responded to the browser's request , Everything is all right .（ With 2 The status code at the beginning indicates success , With 3 The status code at the beginning indicates that the user request has been redirected to another location for various reasons , With 4 The status code at the beginning indicates that there is some error on the client , With 5 The status code at the beginning indicates that the server has encountered an error ）.

（7） The seventh entry in the log indicates the total number of bytes sent to the client . It tells us if the transmission is interrupted （ That is, whether the value is the same as the size of the file ）

Two 、 Configure access logs

stay apache Configuration file for httpd.conf in , One line is configured like this ：

CustomLog "logs/access.log" common

Specifies the directory path of the log ./logs/, Specifies the format of the log , Default common.

common The format is through ：LogFormat "%h %l %u %t \"%r\" %>s %b" common Defined .

The format string in double quotation marks represents specific information .

apache Format string and its meaning ：

%%    Percent sign (Apache2.0.44 Or later ) %a    Distal IP Address %A    This machine IP Address %B    except HTTP The number of bytes sent out of the header %b    With CLF In addition to HTTP The number of bytes sent out of the header , That is to say, when there is no byte transfer, it will display '-' instead of 0. %{Foobar}C    Sent to the server in the request cookieFoobar The content of . %D    The time taken by the server to process this request , In micro units . %{FOOBAR}e    environment variable FOOBAR Value %f    file name %h    Remote host %H    The protocol requested to be used %{Foobar}i    The request header sent to the server Foobar: The content of . %l    Remote login ( from identd And come , If you support it ), Unless IdentityCheck Set to "On", Or you'll get a "-". %m    Requested method %{Foobar}n    Comments from another module Foobar The content of . %{Foobar}o    Answer head Foobar: The content of . %p    The server serves the standard port of the request . %P    Of the subprocess serving this request PID. %{format}P The PID or TID( Threads ID),format The value range of is ：pid and tid(2.0.46 And later versions ) as well as hextid( need APR1.2.0 And above ) %q    Query string ( If there is one "?" guide , Otherwise, an empty string is returned ) %r    First line of request %s    state . For internal redirection requests , This state refers to the state of the original request ,---%>s The status of the last request . %t    Time , In normal log time format ( Standard English format ) %{format}t    Time , use strftime(3) Time in the specified format .( By default, in localized format ) %T    Time taken to process the request , In seconds . %u    Remote user name ( Based on verification information ; If you return status(%s) by 401, It could be a fake ) %U    Requested URL route , Does not contain the query string . %v    The standard for providing service to this request ServerName. %V    according to UseCanonicalName The server name set by the command . </span><span style="font-size:18px;">

【 Add 】"<" and ">" The modifier can be used to specify whether to select the original request or the final request for the request that has been internally redirected . By default ,%s, %U, %T, %D, %r Use the original request , All other format strings choose the final request . for example ,<strong>%>s</strong> It can be used to record the final status of the request , and %<u Then record an original authenticated user who has been internally redirected to a request for non authenticated resources .   If in “%” One or more... Are placed between and variables HTTP The status code , Only when the status code returned by the request belongs to one of the specified status codes , The contents represented by variables will be recorded . for example , If we want to record all the invalid links of the website , Then you can use ：      LogFormat %404{Referer}i BrokenLinks    conversely , If we want to record requests whose status code is not equal to the specified value , Just add one “!” A symbol is enough ：   LogFormat %!200U SomethingWrong 

We can also customize the log format , for example ：

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" " combine

Defined combine Format   among \"%{Referer}i\" \"%{User-Agent}i\" Is the plea header sent to the server and Referer link .