Configuring Access Logging
1. Setting AccessLog Path
| Directive | Values | Description |
|---|---|---|
| ErrorLog | logs/error_log |
Path to the error log file |
| CustomLog | logs/access_log combined |
Path to the access log file and format |
| TransferLog | logs/transfer_log |
Path to the transfer log file (deprecated in 2.4+) |
Example: Setting CustomLog Path
<VirtualHost *:80>
ServerName example.com
CustomLog logs/example_access_log combined
</VirtualHost>
Note: The
CustomLog directive can be used multiple times to log to different files or formats.
2. Understanding Log Formats
| Format | Description | Example |
|---|---|---|
| common | Common log format with IP, identity, user, timestamp, request, status, size | 127.0.0.1 - frank [10/Oct/2023:13:55:36 +0000] "GET /index.html HTTP/1.1" 200 2326 |
| combined | Extended log format including referrer and user agent | 127.0.0.1 - frank [10/Oct/2023:13:55:36 +0000] "GET /index.html HTTP/1.1" 200 2326 "http://example.com/referrer" "Mozilla/5.0..." |
| referer | Logs only the referrer field | "http://example.com/referrer" |
| agent | Logs only the user agent field | "Mozilla/5.0..." |
| custom | Custom format using directives; defined via LogFormat directive | %h %l %u %t "%r" %>s %b |
Example: Custom Log Format Definition
<IfModule log_config_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
</IfModule>
Note: The
combined format is the most commonly used extended format in Apache.
Warning: Custom log formats can include sensitive data. Ensure compliance with privacy regulations.
3. Using Common Log Format
| Directive | Description | Default |
|---|---|---|
| LogFormat | Defines the format of the log entries | %h %l %u %t "%r" %>s %b |
| CustomLog | Specifies the log file and format to use | None |
Example: Configuring Common Log Format
<VirtualHost *:80>
ServerName example.com
CustomLog logs/access_log common
</VirtualHost>
Note: The
common log format is a predefined format in Apache HTTP Server that logs the remote host, remote logname, remote user, time, request line, status code, and response size.
4. Using Combined Log Format
| Directive | Description | Default | Notes |
|---|---|---|---|
| LogFormat | Defines the format of log entries | %h %l %u %t "%r" %>s %b |
Combined log format includes the request line |
Example: Configuring Combined Log Format
<VirtualHost *:80>
ServerName example.com
ErrorLog ${APACHE_LOG_DIR}/example_error.log
CustomLog ${APACHE_LOG_DIR}/example_combined.log combined
</VirtualHost>
Note: The
combined log format is a predefined format that includes the common log format plus the %r (request line) and %>s (status code) fields.
5. Creating Custom Log Formats
Custom log formats in Apache HTTP Server allow you to define the structure and content of access logs. This is achieved using the LogFormat directive.
| Directive | Description | Example |
|---|---|---|
| LogFormat | Defines a custom log format with a name and format string. | LogFormat "%h %l %u %t \"%r\" %>s %b" common |
Example: Defining a Custom Log Format
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedThe LogFormat directive supports various format specifiers to capture different parts of the request and response. These specifiers are enclosed in % and can include:
| Specifier | Description | Example Value |
|---|---|---|
| %h | Remote host name or IP address | 192.168.1.1 |
| %l | Remote logname (from identd, if returnable) | - |
| %u | Remote user name (from auth, if returnable) | joe |
| %t | Time the request was received | [10/Oct/2023:13:55:36 +0000] |
| %r | First line of the request | GET /index.html HTTP/1.1 |
| %>s | Status code sent to the client | 200 |
| %b | Size of response in bytes (excluding headers) | 1234 |
| %{Referer}i | Referer header from the client | https://example.com/page |
| %{User-Agent}i | User-Agent header from the client | Mozilla/5.0... |
Note: The
%t specifier supports custom time formats using the %t[format] syntax. For example, %t[%d/%b/%Y:%H:%M:%S %z] formats the timestamp as 10/Oct/2023:13:55:36 +0000.
Example: Using Custom Time Format
LogFormat "%h %l %u %t[<pre>%d/%b/%Y:%H:%M:%S %z</pre>] \"%r\" %>s %b" custom_time6. Logging Request Time
| Directive | Description | Default | Notes |
|---|---|---|---|
| LogFormat | Defines the format of the log entries | %h %l %u %t "%r" %>s %b |
Used in conjunction with CustomLog |
| %t | Time the request was received | - | Format can be customized using %t with modifiers |
| %T | Time taken to serve the request in seconds | - | Useful for performance monitoring |
| %D | Time taken to serve the request in microseconds | - | More granular than %T |
Example: Custom Log Format Including Request Time
<VirtualHost *:80>
ServerName example.com
CustomLog logs/access_log "%h %l %u %t \"%r\" %>s %b %{%T}t"
</VirtualHost>
Note: The
%t directive can be customized using modifiers like %t{format} to specify the date/time format.
Example: Using Custom Time Format
<VirtualHost *:80>
ServerName example.com
LogFormat "%h %l %u [%d/%b/%Y:%H:%M:%S %z] \"%r\" %>s %b %{%T}t" combined_with_time
CustomLog logs/access_log combined_with_time
</VirtualHost>7. Logging Custom Headers
| Directive | Description | Default | Notes |
|---|---|---|---|
| LogFormat | Defines the format of log entries, including custom headers. | %h %l %u %t "%r" %>s %b |
Used in conjunction with CustomLog. |
| CustomLog | Specifies the log file and format for custom logging. | None | Can include custom headers using %{header-name}i. |
Example: Logging Custom Request Headers
<VirtualHost *:80>
ServerName example.com
CustomLog "/var/log/apache2/access.log" "%h %{User-Agent}i %{Referer}i"
</VirtualHost>Example: Logging Custom Response Headers
<VirtualHost *:80>
ServerName example.com
CustomLog "/var/log/apache2/access.log" "%h %{Content-Type}o %{Server}o"
</VirtualHost>
Note: The
%{header-name}i syntax logs the value of an incoming request header, while %{header-name}o logs the value of an outgoing response header.
8. Configuring Per-VirtualHost Logs
Per-virtual host logging allows you to define custom log formats and destinations for each virtual host. This is useful when different virtual hosts require distinct logging configurations.
| Directive | Description | Default | Context |
|---|---|---|---|
| ErrorLog | Specifies the path to the error log file. | logs/error_log |
server config, virtual host |
| CustomLog | Defines a custom log format and destination for access logs. | None | server config, virtual host |
| LogFormat | Defines a named log format for use with CustomLog. |
None | server config, virtual host |
Example: Setting up per-virtual host logs
<VirtualHost *:80>
ServerName example.com
DocumentRoot /var/www/example
ErrorLog /var/log/example/error.log
CustomLog /var/log/example/access.log combined
</VirtualHost>
<VirtualHost *:80>
ServerName another.com
DocumentRoot /var/www/another
ErrorLog /var/log/another/error.log
CustomLog /var/log/another/access.log combined
</VirtualHost>
Note: Ensure that the log directories exist and have appropriate permissions for the Apache process to write logs.
9. Using Conditional Logging
Conditional logging allows you to log requests based on specific criteria, such as status codes, request methods, or custom conditions. This is useful for filtering logs to focus on specific types of requests.
| Directive | Description | Values | Notes |
|---|---|---|---|
| LogFormat | Defines the format of log entries | "%h %l %u %t \"%r\" %>s %b" |
Customizable format string |
| CustomLog | Specifies the log file and format | logs/access_log combined |
Can use conditional expressions |
Example: Log requests with specific user agent
<If "%{HTTP_USER_AGENT} =~ /bot/i">
CustomLog logs/bot_access.log combined
</If>
Note: The
<If> directive requires the mod_rewrite module to be enabled.
Warning: Complex conditional expressions can impact performance. Use them sparingly.
10. Filtering Logs with SetEnvIf
The SetEnvIf directive allows you to set environment variables based on request attributes, which can then be used to filter access logs. This is particularly useful for excluding certain requests from being logged or applying different log formats to specific client types.
| Directive | Description | Usage Example |
|---|---|---|
| SetEnvIf | Sets an environment variable if the request matches a specified pattern. | SetEnvIf User-Agent "^Mozilla/5.0" mozilla_user |
Example: Exclude Mozilla User Agents from Logging
SetEnvIf User-Agent "^Mozilla/5.0" mozilla_user
CustomLog logs/access_log combined env=!mozilla_user
Note: The
env=!mozilla_user condition in the CustomLog directive ensures that requests from Mozilla user agents are not logged.
Example: Log Requests from Specific IP Ranges
SetEnvIf Remote_Addr "^192\.168\." internal_ip
CustomLog logs/internal_access_log combined env=internal_ip11. Using Piped Logs
Apache HTTP Server supports piping log entries to external programs or scripts for custom processing. This is useful for real-time log analysis, sending logs to remote systems, or applying custom formatting.
| Directive | Description | Example |
|---|---|---|
| CustomLog | Defines a custom log format and destination. Can use pipes to send logs to external programs. | CustomLog "|/usr/bin/logger -t apache" combined |
Note: The pipe symbol (
|) must be escaped or quoted in the configuration file to prevent shell interpretation. The external program must be executable and have appropriate permissions.
12. Setting Log Rotation
| Directive | Description | Default | Notes |
|---|---|---|---|
| ErrorLog | Specifies the file where error messages are logged | logs/error_log |
Can be a relative or absolute path |
| CustomLog | Defines a custom log format and destination | None | Can be used multiple times for different log files |
| LogFormat | Defines a log format for use with CustomLog | %h %l %u %t "%r" %>s %b |
Custom formats can include various variables |
Example: Configuring Log Rotation with CustomLog
<IfModule log_config_module>
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog logs/access_log common
</IfModule>Example: Rotating Logs with External Tools
# Using logrotate (Linux)
/var/log/apache2/access.log {
daily
rotate 5
compress
delaycompress
missingok
notifempty
create 644 www-data www-data
}
Note: Log rotation should be handled by external tools or scripts to prevent log file corruption or loss during rotation.