Jump to content

Log Format


Recommended Posts

Hi,

 

I was just looking through the Raw logs for my site.

 

Here's a sample line from the log

 

>64.124.85.72 - - [03/Oct/2005:22:45:47 -0400] "GET /?ID=29 HTTP/1.1" 200 7471 "http://nirenjan.com/Blog/post.asp?ID=29" "Mozilla/5.0 (compatible; BecomeBot/2.3; MSIE 6.0 compatible; +http://www.become.com/site_owners.html)"

I think I've pretty much figured out most of them, IP, unknown, unknown, timestamp, request, status, returned content size, referrer and user-agent.

 

A few questions in this regard.

  1. Can somebody confirm if my understanding is correct (and fill in those unknowns)?
  2. Is there any way of modifying the timestamp so that it shows a different timezone?
  3. Is the log format customizable?

Edited by Nirenjan
Link to comment
Share on other sites

1. Log format:

 

>64.124.85.72

IP address of machine that made request to server (remote host).

 

-
Identity of client, determined by identd server on client machine. Highly unreliable and should almost never be used.

 

-
UserID of person making request, determined by HTTP authentication. Entry of '-' indicates document is not password protected.

 

>[03/Oct/2005:22:45:47 -0400]

Date/time that server finished processing request.

 

>"GET /?ID=29 HTTP/1.1"

Request line from client, which actually is made of 4 sub-fields:

 

a) GET
HTTP request method used by client. Typically 'GET' or 'POST'; possibly 'HEAD'.

 

b) /
URL path requested by client.

 

>c) ?ID=29

Query string sent by client (parameters sent with 'GET' request).

 

d) HTTP/1.1
Request protocol

 

200
HTTP status code sent back to client.

 

7471
Bytes sent, excluding HTTP headers.

 

>"http://nirenjan.com/Blog/post.asp?ID=29"

Referer header, sent by client.

 

"Mozilla/5.0 (compatible; BecomeBot/2.3; MSIE 6.0 compatible; http://www.become.com/site_owners.html)"
User-Agent header, sent by client.

 

2. Is there any way of modifying the timestamp so that it shows a different timezone?

3. Is the log format customizable?

Technically, yes, the timestamp and the log format can be customized, but such customizations would have to done at the server level (it is not something that you would be able to perform).

 

However, the log formats are in a standardized format across all servers and accounts, known as "NCSA extended/combined log format". This standard format is relied upon by a number of programs that read the server logs (such as AWStats). Changing the log format would most likely break these programs. For these reasons (standardization across accounts/servers and program compatibility), I don't think the Help Desk would be willing to make any changes in the log format. Ultimately, I believe the answer to your last 2 questions would be 'no'.

Link to comment
Share on other sites

Thanks for the info David. :)

 

The reason why I asked if the format was customizable was because my previous host was running IIS, which provided a fairly detailed error message in the log itself whenever my ASP app used to kick the bucket. Does NCSA format provide this kind of error logging when something goes wrong and the server is forced to return a 500 server error or something similiar?

 

Secondly, all the timestamps were at UTC, even when the server went on to British Summer Time. Can I assume that the timestamps will always have a timezone of -0400, or is this likely to change during Daylight savings?

Link to comment
Share on other sites

a) The log we're been talking about here is the web server access log. The format of entries in the server access log makes no accomodation for error messages, because error messages are stored in their own log. Go to CPanel / Error Log in your browser to see the last 300 entries of the web server error log.

 

b) The date/time stamps in the server access log are in the local time zone of the server. The date/time stamps will not always have a timezone offset of '-0400'. The timezone offset of '-0400' is Eastern Daylight Time (meaning we're currently in daylight savings time and the server timezone offset already reflects it). When daylight savings time ends (the last Sunday of this month). the timezone offset should change to '-0500' (Eastern Standard Time).

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...