[SOLVED] Confused about httpd log format and files
Linux - ServerThis forum is for the discussion of Linux Software used in a server related context.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
First of all, what are the various qualifiers "combined", "common" and "combindeio"? I don't understand these.
More inportantly, I want the format shown that I've highlighted -- I've used this elsewhere, instead in access_log I get what appears to be the format beneath it:
If I comment out that one (right after the highlight) I get lines of the word "common":
Code:
209.97.152.248 - - [09/Mar/2024:12:50:03 -0500] "GET /images/favicon.ico HTTP/1.1" 200 5430 (<-- before changing LogFormat)
common (<-- after changing LogFormat)
common
common
common
What do I need to do to get the highlighted format working?
FYI: I have used 5 different HTTPD servers, and I am sure I have not used all of the ones that exist. The Apache HTTPD is only the best known right now.
The NCSA HTTPd server came first, and the early Apache HTTPD server was based upon that.
First of all, what are the various qualifiers "combined", "common" and "combindeio"?
As per the docs (which in a basic Apache install land in /manual/logs.html in your webroot), "This defines the nickname common and associates it with a particular log format string." According to that, you likely want the line to be
Code:
CustomLog "/var/log/httpd/access_log" combined
which is what I use right now. They are defining log formats, and when you comment it out you remove the definition.
Might one presume this is the Apache HTTPD?
And if so, that it is the version from the current SLACKWARE sets?
Yes Apache httpd. Slackware 15.0, not Current.
Quote:
Originally Posted by jayjwa
As per the docs (which in a basic Apache install land in /manual/logs.html in your webroot), "This defines the nickname common and associates it with a particular log format string." According to that, you likely want the line to be
Code:
CustomLog "/var/log/httpd/access_log" combined
which is what I use right now. They are defining log formats, and when you comment it out you remove the definition.
That worked! The CustomLog for common was not commented out, but the log format I wanted specified combined. I changed that to
Code:
LogFormat "%{%Y-%m-%d %H:%M:%S}t %h %>s %B \"%{User-Agent}i\" \"%m %U%q\"" common
And it started logging what I wanted. Thanks.
(Still not sure of what the various common, combined, and combinedio nicknames do, but maybe those don't apply in my case.)
You should leave the log format definitions alone and specify which one you want to use in the vhost definition, as in jayjwa's post.
It seems you have 'common' specified when you want 'combined'.
As long as your suggesting ... Why would I want 'combined' versus 'common'? What exactly is the difference/purpose of combined versus common versus combindeio? Are there designates purposes for each of these "aliases"? Is "combined" the normal/standard one to used? Combined with what? I find this aspect of http logs quite confusing if they all end up in access_log anyway. The docs don't really this clarify for me.
No idea where they originate, you could label them barry, dave or short, if you want.
My point is that the httpd.conf contains the format definition, specifying the layout and an arbitrary label for it, which you can then call by label in each vhost without having to recreate the format template all over again.
Pick one that matches what you want to see in your logs, or make your own.
Last edited by descendant_command; 03-12-2024 at 06:39 AM.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.