Appendix B. Reference information for logging

Table B-1. Escape sequences for custom logs

%%

How to get "%" in the log line. Why would you want to?

%a

Client IP address

%A

Server IP address. Recall that you may be running different virtual hosts on different IP addresses.

%B

Number of data bytes sent back. (i.e. excluding headers)

%b

As for %B except that if the number is 0 then "-" is inserted instead.

%{fubar}C

The value of cookie fubar.

%D

The number of microseconds it took to serve the query. See %T below for a less accurate representation.

%{fubar}e

The value of environment variable fubar when the query was processed.

%f

The name of the file whose contents were ultimately served back to the client.

%H

The request protocol. (Typically HTTP or HTTPS.)

%{fubar}i

Value of the fubar header on the input query. See also %o below.

%l

The remote userid, if provided by RFCnnnn.

%m

The request method. Typically "GET" for our queries, but occasionally "HEAD" if the browser is smart. It may be "POST" for some CGI programs uploading data.

%{fubar}n

A record of a "note" passed from one module to another. Not of interest at our level.

%{fubar}o

The value of header fubar in the outgoing response headers. See also %i above.

%p

The port number of the server. Typically 80.

%P

The process ID of the child that serviced the query. Typically only of use for debugging and trouble-shooting.

%q

The query string component of the URL.

%r

The first line of the query.

%>s

The status code passed back to the client.

%t

The time of the request in standard format.

%{format}t

The time of the query in the format specified. See the manual page for strftime for details of the format.

%T

The time taken to service the query in seconds. See %D above for more accuracy.

%u

The userid used to authenticate to this page, if necessary.

%U

The URL requested without the server name and protocol elements and without any trailing query string.

%v

The server name for the virtual host that was given the query.

HTTP (RFC 2616) is a very subtle protocol with much more happening than you might expect from the simple stuff we have been covering. The following table lists all the status codes it has and which might find themselves in your log files. In practise you will only see a tiny subset of them.

Table B-2. HTTP status codes

100Continue
101Switching protocols
200OK
201Created
202Accepted
203Nonauthoritative information
204No content
205Reset content
206Partial content
300Multiple choices
301Moved permanently
302Found
303See other
304Not modified
305Use proxy
307Temporary redirect
400Bad request
401Unauthorized
402Payment required
403Forbidden
404Not found
405Method not allowed
406Not acceptable
407Proxy authentication required
408Request time-out
409Conflict
410Gone
411Length required
412Precondition failed
413Request entity too large
414Request URI too large
415Unsupported media type
416Requested range not satisfiable
417Expectation failed
500Internal server error
501Not implemented
502Bad gateway
503Service unavailable
504Gateway timed out
505HTTP version unsupported