Understanding Apache Access Logs: A Beginners Guide
Every web developer and system administrator should know the importance of logs. These logs are text files that depict various malfunctions within the website or application, primarily server-side issues. All developers now use Apache Access logs as the primary debugging application.
But what are these log files produced by Apache, and where can I find them? If you have such questions, then you are in the right place.
Read this post till the end to learn about Access Logs and Error Logs by Apache. You will also learn where to locate them and their formats so that you can read them and resolve any web issues.
What Are Apache Access Logs?
Since the dawn of the internet, Apache has been the go-to web server that front-end developers primarily use. It has been in operation since 1995.
As a web developer, you must learn how the website or application handles every user request. Whenever users request information from your website – which can simply be clicking on a link or option – the server handles this request and sends appropriate data back.
Therefore, these Apache Logs contain all data regarding what data users requested from your web app and what resources were provided to them by your server. This includes data like the time of user requests, resources requested, response codes and time, IP addresses of users, etc.
Apart from such information, your Apache logs will also contain data regarding what errors the users have faced. This happens because the server fails to respond to requests. If this happens frequently, then users will stop coming to your site. Now, this is a predicament that you would not want to face.
Therefore, it’s best to access the Apache Access logs and start digging into all the various issues on your website or web application.
Where Can I Find Apache Access Logs?
Depending on which Linux operating system (OS) you are using, the location for all Apache Access log files will vary. However, these are the most common locations of all Apache Access log files:
- Red Hat, Fedora, CentOS: You will find the log files in this location – /var/log/httpd/access_log.
- Debian, Ubuntu: You will find the log files in this location – /var/log/apache2/access.log.
- FreeBSD – You will find the log files in this location – /var/log/httpd-access.log.
Apache Access Log Formats
Since most data logs come in the format of numbers and digits, you will never understand their meaning. Apache HTTP turns them into simple language so that you can understand what the log means in simpler terms.
This is why Apache Access logs are presented in three different formats so that you can understand them easily.
1. Common Log Format
As the name suggests, this is the most common format in which Apache Access logs are shown. Most web servers that run on Apache HTTP server use this to generate CLF-formatted log files.
Here is an example of how this Apache Access log will look in this format:
127.0.0.1 - Scott [10/Dec/2019:13:55:36 -0700] "GET /server-status HTTP/1.1" 200 2326
As you can see, the log line is composed of various elements. They are:
- 127.0.0.01: This refers to the IP address of the users that have made a request.
- The hyphen (-): This defines the identity of the client. As per Apache’s HTTP server documentation, it’s recommended that developers should not rely on this field unless controlled internal work is done.
- Scott: The User ID of the user requesting access to the resources.
- [10/Dec/2019:13:55:36 -0700]: The date and time when the users requested the resource.
- “GET /server-status HTTP/1.1”: The code for which the user is requesting the resource.
- 200: This is the HTTP response status code.
- 2326: This refers to the file size of the resource that has been provided to the user.
2. Combined Log Format
Apart from the common log format, Apache Access logs can also be formatted as per the Combined Log Format. While similar to the common log format, the combined log format has some extra fields. This helps developers get more information that proves to be useful for analysis of debugging operations.
This is what an Apache Access log, as per the Combined log format, looks like:
127.0.0.1 - Scott [10/Dec/2019:13:55:36 -0700] "GET /server-status HTTP/1.1" 200 2326 "http://localhost/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
As you can see from the example above, many of the fields are similar to the common log format. However, there are some extra fields as well. They are:
- “http://localhost/”: This refers to the address related to the resource being requested by the HTTP referrer.
- “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36”: This refers to which browser and OS the user has used. Here, we can see that the user is using Windows 10 (x64 system) and has used Google Chrome.
3. Custom Access Logs
Since Apache Access logs can be configured, you can customize their format as well. This can be done by using the CustomLog directive present within the Apache HTTP server config file. This can be configured in three ways:
I. Multiple Access Logs
If you want one Apache access log to be broken down into multiple access logs (for better clarity and understanding), you can do so easily. Here, each access log can refer to different types of information in different fields.
Here’s an example of what multiple-access logging looks like:
LogFormat "%h %l %u %t \"%r\" %>s %b" commonCustomLog logs/agent_log "%t %{User-agent}i %>s"CustomLog logs/referer_log "%t %h %{Referrer}i"CustomLog logs/access_log common
Here, instead of using three separate log lines, you can simply specify the Apache log format in the CustomLog format line.
II. Conditional Logs
Sometimes, you would prefer to write logs only when certain conditions get met. Here, you make use of various environment variables.
This is what a Conditional Log looks like:
SetEnvIf Request_URI \.png$ png-image-log CustomLog "png-access.log" common env=png-image-log
Here, you can log all requests that try to access a PNG file in a different log file.
II. Log Rotation And Piped Logs
Log Rotation is a process in which older log files continuously get updated when you restart the server. However, this gets done without any form of client request processing interruptions. In most production environments, it’s advised to restart the Apache servers.
On the other hand, piped logs allow you to send different log events to different applications for processing them instead of a single log file. Here’s an example of log rotation done using RotateLogs:
CustomLog "|/usr/local/apache/bin/rotatelogs /var/log/access.log 86400" common
As you can see here, the RotateLogs application integrated with Apache servers can redirect all logs without a server restart. Here, the /var/log/access.log log file will get rotated every 24 hours.
Conclusion
Analyzing Apache access logs is crucial for optimizing your website and preventing any form of error. This is primarily done to improve the performance of the website so that you get to know specifically what error a user faces.
If you need help regarding Apache Access logs, feel free to comment your questions down below!
More Resources:
