Apache Guide: Logging, Part 3 -- Custom Logs

Long ago, log files came in one format. It was called the common format, and you were pretty much stuck with it. Then came custom log file format, and it turned out to be such a good idea that even the common format was reimplemented as a custom log file format.

In the beginning was the common log-file format, and it was good. But as Apache grew in popularity, its designers decided to expand upon the workhorse common format, thus leading us to an age where you can customize your log files. Rich Bowen explains how to do so.

In this article, you'll find out how to make your log files look like whatever you want, and have whatever information in them that you want.


Here's the lightning overview for those of you that just want to get something working, and don't care about all the details. You'll need to look at the LogFormat and CustomLog directives. There are several examples in your default httpd.conf file.

LogFormat sets up a format and gives it a nickname by which you can refer to it. CustomLog sets up an actual log file, and indicates the format (by nickname, usually) that file will use.


The LogFormat directive sets up a log format, and a nickname by which you can refer to that format.

For example, in your default httpd.conf file, you'll find the following line:

     LogFormat "%h %l %u %t \"%r\" %>s %b" common

This directive creates a log format called "common", which is in the format specified in quotes. Each one of those letters means a particular piece of information, which is put into the log file in the order indicated.

The available variables, and their meanings, are listed in the documentation, and are reproduced below:

     %...a:          Remote IP-address
     %...A:          Local IP-address
     %...B:          Bytes sent, excluding HTTP headers.
     %...b:          Bytes sent, excluding HTTP headers. In CLF format
                     i.e. a '-' rather than a 0 when no bytes are sent.

     %...{FOOBAR}e:  The contents of the environment variable FOOBAR
     %...f:          Filename
     %...h:          Remote host
     %...H           The request protocol
     %...{Foobar}i:  The contents of Foobar: header line(s) in the request
                     sent to the server.
     %...l:          Remote logname (from identd, if supplied)
     %...m           The request method
     %...{Foobar}n:  The contents of note "Foobar" from another module.
     %...{Foobar}o:  The contents of Foobar: header line(s) in the reply.
     %...p:          The canonical Port of the server serving the request
     %...P:          The process ID of the child that serviced the request.
     %...q           The query string (prepended with a ? if a query string exists,
                     otherwise an empty string)
     %...r:          First line of request
     %...s:          Status.  For requests that got internally redirected, this is
                     the status of the *original* request --- %...>s for the last.
     %...t:          Time, in common log format time format (standard english format)
     %...{format}t:  The time, in the form given by format, which should
                     be in strftime(3) format. (potentially localised)
     %...T:          The time taken to serve the request, in seconds.
     %...u:          Remote user (from auth; may be bogus if return status (%s) is 401)
     %...U:          The URL path requested.
     %...v:          The canonical ServerName of the server serving the request.
     %...V:          The server name according to the UseCanonicalName setting.

In each case, the "..." indicates an (optional) condition. If the condition is met, then the particular. If the condition is ommitted, then the variable will be replaced with a "-" if it is not defined. I'll give some examples of this in a minute.

This article was originally published on Sep 5, 2000
Page 1 of 2

Thanks for your registration, follow us on our social networks to keep up-to-date