Log formats for HTTP Server (powered by Apache)

This topic provides information about log formats and log files.

Important: Information for this topic supports the latest PTF levels for HTTP Server for i5/OS . It is recommended that you install the latest PTFs to upgrade to the latest level of the HTTP Server for i5/OS. Some of the topics documented here are not available prior to this update. See http://www.ibm.com/servers/eserver/iseries/software/http/services/service.htm Link outside Information Center

for more information.

Use the following information to understand log formats. For information on how to configure logs, see Set up logs on HTTP Server (powered by Apache).

Log files contain one line for each request. A line is composed of several tokens separated by spaces. If a token does not have a value then it is represented by a hyphen (-). A line in a log file might look like the following:

192.168.1.3 - - [18/Feb/2000:13:33:37 -0600] "GET / HTTP/1.0" 200 5073

The following log file types are supported:

Common (Access)

This format is the common log file format defined by the W3C working group. This format is compatible with many industry standard log tools. For more information see the W3C common log format web site at http://www.w3.org/Daemon/User/Config/Logging.html Link outside Information Center

The common log format is defined by the following string:

"%h %l %u %t \"%r\" %>s %b"

Extended (Access, Referer, and Agent)

This format has two types: NCSA extended log format and the W3C extended log format. The NCSA extended log format is the common log format appended with the agent and referer information. The W3C extended log format is defined by the W3C working group and allows you to determine the format of the log entry. For more information see the W3C extended log format web site at http://www.w3.org/TR/WD-logfile Link outside Information Center

NCSA's extended format is defined by the following string:

"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\"\%{User-agent}i\"

Data Description Specification (DDS): This format is an iSeries™ database (physical) file in QSYS.LIB. This format allows you to write a database query program to generate reports. This format contains the same information as the common log format.

Tokens used to define log file formats

Token	Description
%...a	The remote client IP address. Example: `192.168.1.3`
%...A	The local client IP address. Example: `192.168.1.3`
%...b	The number of bytes transmitted, excluding HTTP headers in common log format. Example: `- = no bytes transmitted`
%...B	The number of bytes transmitted, excluding HTTP headers in extended log format. Example: `0 = no bytes transmitted`
%...{var}e	The contents of the environment variable named var.
%...f	The requested file name. Example: `/www/index.htm`
%...h	The remote host name or IP address. Example: `hal.ibm.com or 192.168.1.3`
%...H	The requested protocol.
%...{var}i	The contents of the HTTP header line named var. Example: `%{User-agent}i = Mozilla/4.5 [en] (WinNT; U)`
%...l	The remote logname.
%...m	The request method.
%...{var}n	The contents of the note named `var`.
%...{var}o	The contents of the header lines named `var` in the reply.
%...p	The canonical Port of the server serving the request. Example: `80`
%...P	The process ID that serviced the request. Example: `837`
%...q	The query string (or search argument) prepended with a "?". Example: `?name=hal`
%...r	The first line of the request. Example: `GET / HTTP/1.0`
%...s	The server response status. Example: `200`
%...t	The time in common log format. Example: `[21/Mar/2000:14:08:03 -0600]`
%...{strftime}t	The time in strftime format.
%...T	The time (in seconds) taken to serve the request. Example: `1`
%...u	The name of the authenticated remote user. Example: `hal`
%...U	The requested URL path. Example: `/`
%...v	The canonical server name of the server serving the request.
%...V	The server name according to the UseCanonicalName setting.

Note:

Logformat %D is not supported.

The "..." can be replaced with a condition for inclusion or it can be omitted. The character < determines if the original value is logged. The greater than character (>) determines if the redirected value is logged. The condition may be preceded by a ! to reverse the condition. For example:

Condition	Description
%>s	Logs the returned status.
%{User-agent}i	Logs User-agent on all requests.
%400,501{User-agent}i	Logs User-agent only when a 400 error (Bad Request) or a 501 error (Not Implemented) is encountered.
%!200,304,302{Referer}i	Logs Referer on all requests which did not return some sort of normal status.