Log file format tokens

This topic provides information about tokens used to define log file formats.

Table 1. Tokens that define log file formats
Token Description
%% The percent sign.
%a The remote client IP address. Example: 192.168.1.3
%{c}a Underlying peer IP address of the connection (see the mod_remoteip module).
%A The local client IP address. Example: 192.168.1.3
%B Size of response in bytes, excluding HTTP headers.
%b Size of response in bytes, excluding HTTP headers. In CLF format, i.e. a '-' rather than a 0 when no bytes are sent.
%{VARNAME}C The contents of cookie VARNAME in the request sent to the server. Only version 0 cookies are fully supported.
%D The time taken to serve the request, in microseconds.
%{VARNAME}e The contents of the environment variable named VARNAME.
%f The requested file name. Example: /www/index.htm
%h The remote host name or IP address if HostnameLookups is set to Off. Example: hal.ibm.com or 192.168.1.3
%H The requested protocol.
%{VARNAME}i The contents of the HTTP header line named VARNAME. Example: %{User-agent}i = Mozilla/4.5 [en] (WinNT; U)
%k Number of keepalive requests handled on this connection. Interesting if KeepAlive is being used, so that, for example, a '1' means the first keepalive request after the initial one, '2' the second, etc...; otherwise this is always 0 (indicating the initial request).
%l The remote logname.
%L The request log ID from the error log (or '-' if nothing has been logged to the error log for this request). Look for the matching error log line to see what request caused what error.
%m The request method.
%{VARNAME}n The contents of the note named VARNAME from another module.
%{VARNAME}o The contents of the header lines named VARNAME in the reply.
%p The canonical Port of the server serving the request. Example: 80
%{format}p The canonical port of the server serving the request, or the server's actual port, or the client's actual port. Valid formats are canonical, local, or remote.
%P The process ID that serviced the request. Example: 837
%{format}P The process ID or thread ID of the child that serviced the request. Valid formats are pid, tid, and hextid.
%q The query string (or search argument) prepended with a "?". Example: ?name=hal
%r The first line of the request. Example: GET / HTTP/1.0
%R The handler generating the response (if any).
%s The server response status. For requests that have been internally redirected, this is the status of the original request. Use %>s for the final status. Example: 200
%t The time the request was received in common log format. Example: [21/Mar/2000:14:08:03 -0600] . The last number indicates the timezone offset from GMT
%{format}t

The time, in the form given by format, which should be in an extended strftime(3) format (potentially localized). If the format starts with begin: (default) the time is taken at the beginning of the request processing. If it starts with end: it is the time when the log entry gets written, close to the end of the request processing. In addition to the formats supported by strftime(3), the following format tokens are supported:

  • sec.….….….number of seconds since the Epoch
  • msec.….…...number of milliseconds since the Epoch
  • usec.….……number of microseconds since the Epoch
  • msec_frac…millisecond fraction
  • usec_frac….microsecond fraction

These tokens can not be combined with each other or strftime(3) formatting in the same format string. You can use multiple %{format}t tokens instead.

%T The time (in seconds) taken to serve the request. Example: 1
%{UNIT}T The time taken to serve the request, in a time unit given by UNIT. Valid units are ms for milliseconds, us for microseconds, and s for seconds. Using s gives the same result as %T without any format; using us gives the same result as %D.
%u The name of the authenticated remote user. Example: hal
%U The requested URL path. Example: /
%v The canonical server name of the server serving the request.
%V The server name according to the UseCanonicalName setting.
%X Connection status when response is completed:

X= Connection aborted before the response completed.

+= Connection may be kept alive after the response is sent.

-= Connection will be closed after the response is sent.
%I Bytes received, including request and headers. Cannot be zero. You need to enable mod_logio to use this.
%O Bytes sent, including headers. May be zero in rare cases such as when a request is aborted before a response is sent. You need to enable mod_logio to use this.
%S Bytes transferred (received and sent), including request and headers, cannot be zero. This is the combination of %I and %O. You need to enable mod_logio to use this.
%{VARNAME}^ti The contents of VARNAME: trailer line(s) in the request sent to the server.
%{VARNAME}^to The contents of VARNAME: trailer line(s) in the response sent from the server.
Note:
  • The "..." can be replaced with a condition for inclusion or it can be omitted. The character < determines if the original value is logged. The greater than character (>) determines if the redirected value is logged. The condition may be preceded by a ! to reverse the condition. For example:
    Condition Description
    %>s Logs the returned status.
    %{User-agent}i Logs User-agent on all requests.
    %400,501{User-agent}i Logs User-agent only when a 400® error (Bad Request) or a 501 error (Not Implemented) is encountered.
    %!200,304,302{Referer}i Logs Referer on all requests which did not return some sort of normal status.

Log file format tokens forErrorLogFormat.

Table 2. Format strings that define error log file format.
Token Description
%% The percent sign.
%a Client IP address and port of the request.
%{c}a Underlying peer IP address and port of the connection (see the mod_remoteip module).
%A Local IP-address and port.
%{name}e Request environment variable name.
%E APR/OS error status code and string.
%F Source file name and line number of the log call.
%{name}i Request header name
%k Number of keep-alive requests on this connection.
%l Loglevel of the message.
%L Log ID of the request.
%{c}L Log ID of the connection.
%{C}L Log ID of the connection if used in connection scope, empty otherwise.
%m Name of the module logging the message.
%M The actual log message.
%{name}n Request note name
%P Process ID of current process.
%T Thread ID of current thread.
%{g}T System unique thread ID of current thread (the same ID as displayed by e.g. top; currently Linux® only).
%t The current time.
%{u}t The current time including micro-seconds.
%{cu}t The current time in compact ISO 8601 format, including micro-seconds.
%v The canonical ServerName of the current server.
%V The server name of the server serving the request according to the UseCanonicalName setting.
\ (backslash space) Non-field delimiting space.
% (percent space) Field delimiter (no output).
Modifiers  
Modified Token Meaning
%-{Referer}i Logs a - if Referer is not set.
%+{Referer}i Omits the entire line if Referer is not set.
%4{Referer}i Logs the Referer only if the log message severity is higher than 4.