How do I read an Apache log? [closed]

Posted on

How do I read an Apache log? [closed] – Managing your servers can streamline the performance of your team by allowing them to complete complex tasks faster. Plus, it can enable them to detect problems early on before they get out of hand and compromise your business. As a result, the risk of experiencing operational setbacks is drastically lower.

But the only way to make the most of your server management is to perform it correctly. And to help you do so, this article will share nine tips on improving your server management and fix some problem about apache-2.2, logging, , , .

I see lines like this in my apache usage log, but don’t understand how to read them:

123.16.65.84 - - [04/Nov/2011:00:30:09 +0000] "GET /media/product/3596_5084_120.jpg HTTP/1.1" 304 175 "http://www.audaaai.com/loa-hi-fi_dm13.html&brand=36" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.1; .NET CLR 2.0.50727; AskTbMPC2/5.11.0.15286)"

How can I understand these lines?

Solution :

  • 123.16.65.84 is the IP-address of the client.
  • The first hyphen would contain the client-identifier from identd, but a hyphen is in its place as that information is unavailable.
  • The second hyphen would contain the users username, if the user were authenticated by http.
  • [04/Nov/2011:00:30:09 +0000] is the time of the request.
  • GET is the request method
  • /media/product/3596_5084_120.jpg is the request URI
  • HTTP/1.1 is the protocol and version
  • 304 is the returned status code. (304 means ‘Not Modified’)
  • 175 is the amount of bytes in the returned body.
  • http://www.audaaai.com/loa-hi-fi_dm13.html&brand=36 is the referer-URL
  • Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.1; .NET CLR 2.0.50727; AskTbMPC2/5.11.0.15286) is the user agent / browser used by the client.

Check out http://httpd.apache.org/docs/1.3/logs.html#common for a more thorough explanation.

Leave a Reply

Your email address will not be published.