The Common Log Format comes from the NCSA and CERN web servers of the early 1990s and
was never formally standardised. Its de facto definition today is the Apache HTTP
Server’s LogFormat string %h %l %u %t "%r" %>s %b; this page
follows Apache’s mod_log_config documentation. Each line is one request.
Common Log Format
| # | Field | Directive | Meaning | Example |
|---|---|---|---|---|
| 1 | Remote host | %h | The client’s host name, or its IP address when name lookups are off (the default). | 127.0.0.1 |
| 2 | Remote log name | %l | The user name reported by the client’s identd (RFC 1413); almost always -. | - |
| 3 | Remote user | %u | The user name from HTTP authentication, or -. | frank |
| 4 | Time | %t | When the request was received, in square brackets; see time. | [10/Oct/2000:13:55:36 -0700] |
| 5 | Request line | "%r" | The first line of the request, in double quotes: method, path and protocol. | "GET /apache_pb.gif HTTP/1.0" |
| 6 | Status | %>s | The final HTTP status code. | 200 |
| 7 | Size | %b | Bytes of response body sent, not counting headers; - when none. | 2326 |
Fields are separated by single spaces. A field with no value is a hyphen.
Combined Log Format
The NCSA extended or “combined” format adds two quoted fields:
%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-agent}i".
| # | Field | Meaning |
|---|---|---|
| 8 | Referer | The Referer request header: the page that linked here; "-" if none. |
| 9 | User agent | The User-Agent request header. |
A virtual-host variant puts %v, the server name, in front of the common
fields. nginx’s predefined combined format (ngx_http_log_module
documentation) writes the same fields from its own variables:
$remote_addr - $remote_user [$time_local] "$request" $status
$body_bytes_sent "$http_referer" "$http_user_agent", with a literal
- in the second field. By default nginx escapes ",
\ and bytes below 32 or above 126 as \xXX, and logs
- for a variable with no value.
Time
[day/month/year:hour:minute:second zone]: a two-digit day, the
three-letter English month name, a four-digit year, a 24-hour time, and the offset from
UTC as +hhmm or -hhmm. The time is local to the server.
Escaping
Since Apache 2.0.46, values that come from the request are escaped so a line cannot be
forged: bytes that are not printable are written \xhh, double quotes and
backslashes get a backslash in front, and whitespace characters use C escapes such as
\n and \t. This applies to %h, %l,
%u, %r, %i and the other text directives, but not
to numbers, addresses or times.
Apache format directives
Servers can log any mix of these, so a “CLF” file may carry more fields than the seven above.
| Directive | Value |
|---|---|
%% | A percent sign |
%a, %{c}a | Client IP address; the underlying peer address of the connection |
%A | Local (server) IP address |
%B, %b | Body bytes sent; %b writes - instead of 0 |
%{name}C | A request cookie |
%D | Time taken, in microseconds |
%{name}e | An environment variable |
%f | The file name served |
%h, %{c}h | Remote host; host of the underlying connection |
%H | Request protocol, such as HTTP/1.1 |
%{name}i | A request header |
%k | Keep-alive requests handled on this connection so far |
%l | Remote log name (identd) |
%L | The request’s log ID in the error log |
%m | Request method |
%{name}n | A note set by a module |
%{name}o | A response header |
%p, %{canonical|local|remote}p | Server port |
%P, %{pid|tid|hextid}P | Process or thread ID of the worker |
%q | Query string with its ?, or empty |
%r | First line of the request |
%R | The handler that made the response |
%s, %>s | Status of the original request; final status |
%t, %{format}t | Time received; or in a strftime format, optionally prefixed begin: or end:, or one of sec, msec, usec (since the epoch), msec_frac, usec_frac |
%T, %{ms|us|s}T | Time taken, in seconds or the given unit |
%u | Remote user |
%U | URL path, without the query string |
%v, %V | Canonical server name; server name per UseCanonicalName |
%X | Connection state at the end: X aborted, + may be kept alive, - will be closed |
%I, %O, %S | Bytes received, sent, and both, headers included (mod_logio) |
%{name}^ti, %{name}^to | A request or response trailer |
A directive can be limited to some status codes, as in
%400,501{User-agent}i, or all but some, as in
%!200,304{Referer}i; otherwise it logs -. <
and > choose the original or the final request after an internal
redirect.