httpd.request.logs(4) (Sun WebServer 2.1 Command Reference)

Sun WebServer 2.1 Command Reference

httpd.request.logs(4)

NAME

^TM

SYNOPSIS

site_path/log-prefix

DESCRIPTION

The httpd.request.logs file logs all incoming requests to a server request log file. Sun WebServer generates log files using one of three log file formats configurable by the administrator: the Common Log Format (CLF), the Extended Common Log Format (ECLF) also known as the Combined Log Format, or the Extended Log Format (ELF). The location of a request log file is set by the log-prefix directive in the site_path/conf/httpd.site.conf or in the Sun WebServer GUI.

The most recent log file can be accessed through the log prefix. If the default prefix http_log located at site_path/http_log has the ELF log type, then apart from having log files with names /site_path/http_log.elf.1, you will also have a symbolic link called site_path/http_log.elf, which points to the latest log file that the server is writing.

Note -

If you are running on the Solaris ISP Server^TM software and you are also running the network cache accelerator (NCA), check the NCA log file (specified with the logd_path_name directive in /etc/ncalog.conf) for additional log entries. Sun WebServer does not record all requests in the site request log on ports where NCA is running. Also, note that cache misses may be logged in both the Sun WebServer site request log as well as the NCA log, and some events such as requests for the site on ports not running NCA may be logged only in the Sun WebServer site request log.

Common Log Format (CLF)

The CLF format is used by most HTTP servers and analysis tools.

To get CLF logs, set log_type to "clf" in the web site configuration file.

The entries in the Common Log File (CLF) logs have the following format:

host rfc931 authuser [DD/MM/YYYY:hh:mm:ss] "request" ddd bbbb

The following list explains the log entry fields::

host: The DNS name or the IP number of the remote client.
rfc931: The information returned on this client for this request, otherwise (-).
authuser: The user ID sent for authentication, otherwise (-).
DD/MM/YYYY:hh:mm:ss: The date and time of the request.
request: The first line of the HTTP request as sent by the client.
ddd: The HTTP status code returned by the server, if not available (-).
bbbb: The number of bytes sent, not including the HTTP header, if not available (-).

Extended Common Log Format (ECLF)

An extended common log format file is a variant of the common log format file with two additional fields at the end of the line, the referrer and the user agent fields.

To get ECLF logs, set log_type to "eclf" in the web site configuration file.

The entries in the ECLF log files have the following format:

<host> rfc931 authuser [DD/MM/YYYY:hh:mm:ss GMT_offset] \\
"request" ddd bbbb "referrer" "user_agent"

The following list explains the log entry fields:

host: The DNS name or the IP number of the remote client.
rfc931: The information returned on this client by identd for this request, otherwise (-).
authuser: The user ID sent for authentication, otherwise "-".
DD/MM/YYYY:hh:mm:ss: The date and time of the request.
GMT_offset: The difference between the local time and Greenwich Mean Time (GMT).
request: The first line of the HTTP request as sent by the client.
ddd: The status code returned by the server, if not available (-).
bbbb: The number of bytes sent, not including the HTTP header, if not available (-).
referrer: The URL the client was on before requesting your URL, if not available, (-).
useragent: The software the client claims to be using, if not available (-).

Extended Log Format (ELF)

The Extended Log File (ELF) format is a flexible format for recording HTTP requests, which is particularly suited for log analysis tools. ELF records more information than the CLF format. It contains a sequence of lines containing ASCII characters delimited by a new line. Lines that start with # are comment directives.

To get ELF logs, set log_type to "elf" in the web site configuration file.

The entries in the ELF log files have the following format:

date time cs-method cs-uri sc-status time-taken bytes cs-ip cs-host

The following list explains the log entry fields:

date: The date in YYYY-MM-DD format.
time: The time the request was accepted by the server in the 24-hour format in the machine's time zone.
cs-method: The client-to-server HTTP method.
cs-uri: The client-to-server requested URI.
sc-status: The server-to-client HTTP status code in the response.
time-taken: The time taken to process the request.
bytes: The number of bytes sent.
cs-ip: The client-to-server IP address and port of the client.
cs-host: The DNS name of the remote client, if not available "-".

EXAMPLES

Example 1

Extended log format (elf):

#Version: 1.0
#Software: Sun_WebServer/2.1
#Start-Date: 1998-05-18 17:57:20
#Fields: date time cs-method cs-uri sc-status time-taken bytes \\
cs-ip cs-host cs-referer cs-agent

1998-05-18 17:57:01 GET / 200 0 848 129.146.114.74:49028 -

1998-05-18 17:57:13 GET /swshelp/ht_helpTOC.doc.html \\
304 0 142 129.146.114.74:49028 -

1998-05-18 17:57:20 GET /swshelp/ht_server_cache_settings.html \\
304 0 142 129.146.114.74:49028 -

1998-05-18 17:57:21 GET /swshelp/frame.ht_server_cache_settings1.html \\
304 1 142 129.146.114.74:49032 -

1998-05-18 17:57:21 GET /swshelp/SWSbanner.gif \\
304 0 142 129.146.114.74:49032 -

Example 2

Common log format (clf):

129.146.114.74 - - [18/May/1998:17:47:58 -0700] \\
"GET /monhelp/SISP_Banner.html HTTP/1.0" 200 558

129.146.114.74 - - [18/May/1998:17:48:11 -0700] \\
"GET /swshelp/ht_server_cache_settings.html HTTP/1.0" 200 379

129.146.114.74 - - [18/May/1998:17:48:12 -0700] \\
"GET /swshelp/ht_server_cache_settings1.html HTTP/1.0" 200 2645

129.146.114.74 - - [18/May/1998:17:48:12 -0700] \\
"GET /swshelp/SWS_Banner.html HTTP/1.0" 200 330

129.146.114.74 - - [18/May/1998:17:48:25 -0700] \\
"GET /swshelp/ht_server_web_sites_list.html HTTP/1.0" 200 379

129.146.114.74 - - [18/May/1998:17:49:09 -0700] \\
"GET /mchelp/awsTOC.doc.html HTTP/1.0" 200 5953

129.146.114.74 - - [18/May/1998:17:48:12 -0700] \\
"GET /swshelp/SWSbanner.gif HTTP/1.0" 200 16712

Example 3

Extended common log format (eclf):

129.146.114.74 - - [18/May/1998:18:02:56 -0700] \\
"GET /swshelp/ht_server_web_sites_list.html HTTP/1.0" 304 142 \\
"http://isp-doc1/swshelp/ht_helpTOC.doc.html" \\
"Mozilla/4.02 [en] (X11; U; SunOS 5.6 sun4m)"

129.146.114.74 - - [18/May/1998:18:03:03 -0700] \\
"GET /swshelp/ht_server_iplist2.html HTTP/1.0" 200 2377 \\
"http://isp-doc1/swshelp/ht_helpTOC.doc.html" \\
"Mozilla/4.02 [en] (X11; U; SunOS 5.6 sun4m)"

129.146.114.74 - - [18/May/1998:18:03:05 -0700] \\
"GET /swshelp/ht_server_iplist3.html HTTP/1.0" 200 341 \\
"http://isp-doc1/swshelp/ht_helpTOC.doc.html" \\
"Mozilla/4.02 [en] (X11; U; SunOS 5.6 sun4m)"

129.146.114.74 - - [18/May/1998:18:03:02 -0700] \\
"GET /swshelp/frame.ht_server_iplist2.html HTTP/1.0" 200 249 \\
"http://isp-doc1/swshelp/ht_helpTOC.doc.html" \\
"Mozilla/4.02 [en] (X11; U; SunOS 5.6 sun4m)"

ATTRIBUTES

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWhttp
Interface Stability	Stable