How do I read an Apache log? [closed]

by

I see lines like this in my apache usage log, but don’t understand how to read them:

123.16.65.84 - - [04/Nov/2011:00:30:09 +0000] "GET /media/product/3596_5084_120.jpg HTTP/1.1" 304 175 "http://www.audaaai.com/loa-hi-fi_dm13.html&brand=36" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.1; .NET CLR 2.0.50727; AskTbMPC2/5.11.0.15286)"

How can I understand these lines?

Answer

  • 123.16.65.84 is the IP-address of the client.
  • The first hyphen would contain the client-identifier from identd, but a hyphen is in its place as that information is unavailable.
  • The second hyphen would contain the users username, if the user were authenticated by http.
  • [04/Nov/2011:00:30:09 +0000] is the time of the request.
  • GET is the request method
  • /media/product/3596_5084_120.jpg is the request URI
  • HTTP/1.1 is the protocol and version
  • 304 is the returned status code. (304 means ‘Not Modified’)
  • 175 is the amount of bytes in the returned body.
  • http://www.audaaai.com/loa-hi-fi_dm13.html&brand=36 is the referer-URL
  • Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.1; .NET CLR 2.0.50727; AskTbMPC2/5.11.0.15286) is the user agent / browser used by the client.

Check out http://httpd.apache.org/docs/1.3/logs.html#common for a more thorough explanation.

Attribution
Source : Link , Question Author : haiq , Answer Author : Kvisle

Leave a Comment