Home | Sitemap | FAQ | Contact Us

Apache/NCSA Combined Log Format

A "combined" log file format is like this: - leon [01/Jul/2002:12:11:52 +0000] "GET /index.html HTTP/1.1" 200 431"http://www.loganalyzer.net/" "Mozilla/4.05 [en] (WinNT; I)" "USERID=CustomerA;IMPID=01234"

The following are the fields in Combined log format (with the three additional fields shown in bold):

host rfc931 username date:time request statuscode bytes referrer user_agent cookie

The following is a description of the fields in the fields in the Combined log format:

    host ( in the example)
         The IP address or host/subdomain name of the HTTP client that made the HTTP resource request.

    rfc931 ("-" in the example)
         The identifier used to identify the client making the HTTP request. If no value is present, a "-" is substituted.

    username (leon in the example)
         The username, (or user ID) used by the client for authentication. If no value is present, a "-" is substituted.

    date:time ([01/Jul/2002:12:11:52 +0000] in the example)
         The date and time stamp of the HTTP request.
         The fields in the date/time field are: [dd/MMM/yyyy:hh:mm:ss +-hhmm]
         where the fields are defined as follow:

         dd is the day of the month
    MMM is the month
    yyy is the year
    :hh is the hour
    :mm is the minute
    :ss is the seconds
    +-hhmm is the time zone

    In practice, the day is typically logged in two-digit format even for single-digit days. For example, the second day of the month would be represented as 02. However, some HTTP servers do log a single digit day as a single digit. When parsing log records, you should be aware of both possible day representations.

request ("GET /index.html HTTP/1.1" in the example)
  The HTTP request. The request field contains three pieces of information. The main piece is the requested resource (index.html). The request field also contains the HTTP method (GET) and the HTTP protocol version (1.1).

statuscode (200 in the example)
  The status is the numeric code indicating the success or failure of the HTTP request.

bytes (431 in the example)
   The bytes field is a numeric field containing the number of bytes of data transferred as part of the HTTP request, not including the HTTP header.

referrer ("http://www.loganalyzer.net/" in the example)
  The URL which linked the user to your site. (Optional)

user_agent ("Mozilla/4.05 [en] (WinNT; I)" in the example)
  The Web browser and platform used by the visitor to your site.(Optional)

cookies ("USERID=CustomerA;IMPID=01234" in the example)
  Cookies are pieces of information that the HTTP server can send back to client along the with the requested resources. A client's browser may store this information and subsequently send it back to the HTTP server upon making additional resource requests. The HTTP server can establish multiple cookies per HTTP request.

Cookies take the form KEY = VALUE. Multiple cookie key value pairs are delineated by semicolons(;).

Nihuo Web Log Analyzer supports Apache/NCSA Combined Log Format-- it can process log files in Apache/NCSA Combined Log Format , and generate dynamic statistics from them, analyzing and reporting server traffic. Please give try, you will find the best Apache log analyzer and the best IIS log file analyzer in the world.

Nihuo Web Log Analyzer also supports other log formats; See the list containing Apache/NCSA Combined Log Format and all other supported formats.


Home | Features | Free Trial | Buy Now! | Support
Contact us | Privacy Policy | Reseller
Copyright © 2001-2014 Nihuo Software,Inc