Re: Common Log format

Chris Adie (C.J.Adie@ed.ac.uk)
Thu, 13 Apr 1995 05:03:30 +0500

brian@hotwired.com wrote:
> The choice is yours if you're going to change from logging the actual
> request to logging the actual object served; maybe this is an issue for
> CLF-NG. A few of us have ideas about that - like maybe it should really
> just be an API whose expression can be a simple string of variables,
> like
>
> $HOST $IDENTD $AUTHUSER [$MDAY/$MN/$YR:$HR:$MN:$SC $GMT] "$REQUEST" $ERRCODE $LENGTH
>
> to represent the current CLF. This string could be shared with log file
> analysers and other applications that required it.

I've been thinking about this too. Let's call the string a "log
template". Why not base it on the strftime() function? The current
CLF would be:

%R %i %u [%d/%m/%Y:%H:%M:%S %O] "%q" %s %n

where:

%R remote client name
%i user ident
%u authenticated user name
%O offset from GMT
%q literal request from client
%s status code
%n number of bytes sent

and the others are as defined by strftime().

Other things you might want are:

%l IP address the request was received on
%L host name corresponding to %l
%Q document actually served
%r remote client IP address
etc

You could also record an arbitary HTTP header using (eg)
%:user-agent:

Regards,

Chris Adie PLEASE NOTE NEW ADDRESS &
Edinburgh University Computing Service PHONE/FAX NUMBERS!
James Clark Maxwell Building Phone: +44 131 650 6773
Kings Buildings Fax: +44 131 650 6552
Edinburgh EH9 3JZ, United Kingdom Email: C.J.Adie@ed.ac.uk