Master Tomcat and Apache Log Formats: Patterns, Parameters, and Browser Differences

Tomcat Access Log Configuration

In server.xml the pattern attribute defines the log format.

Default pattern

pattern="%h %l %u %t \"%r\" %s %b"

Recommended pattern (includes client IP from X-Forwarded-For, request time in ms and User-Agent)

pattern="%{X-FORWARDED-FOR}i %l %u %t %r %s %b %D %{User-Agent}i"

Sample log entry

192.168.3.14 - - [14/Dec/2017:17:56:05 +0800] "GET /solr/admin/cores?_\=1513245362283&indexInfo=false&wt=json HTTP/1.1" 200 487 3

Common conversion specifiers

%a  : Remote IP address
%A  : Local IP address
%b  : Bytes sent (CLF, "-" if zero)
%B  : Bytes sent (exact)
%D  : Processing time in milliseconds
%h  : Remote host name
%H  : Request protocol
%I  : Current request thread name
%l  : Remote logical username from identd (always "-")
%m  : Request method
%p  : Local port
%q  : Query string (prefixed with "?" if present)
%r  : First line of the request
%s  : HTTP status code
%S  : User session ID
%t  : Date and time in common log format
%T  : Processing time in seconds
%u  : Remote user authentication
%U  : Requested URL path
%v  : Local server name

Apache HTTPD Access Log Configuration

Recommended LogFormat (combined)

LogFormat "%{X-Forwarded-For}i %l %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

Key conversion specifiers

%a  : Remote IP address
%A  : Local IP address
%B  : Bytes sent (exact)
%b  : Bytes sent in CLF format
%{FOOBAR}e : Environment variable FOOBAR
%f  : File name
%h  : Remote host
%H  : Request protocol
%{Foobar}i : Request header Foobar
%l  : Remote login name (identd)
%m  : Request method
%{Foobar}n : Note from another module
%{Foobar}o : Response header Foobar
%p  : Server port used for the response
%P  : Process ID handling the request
%q  : Query string (including leading "?")
%r  : First line of request
%s  : Status code (use %>s for final status after redirects)
%t  : Time in common log format
%{format}t : Time formatted with custom pattern
%T  : Time taken to serve request (seconds)
%u  : Remote user (auth)
%U  : Requested URL path
%v  : ServerName handling the request
%V  : Canonical server name (UseCanonicalName)
%{Referer}i : Referer header
%{User-agent}i : User-Agent header
%{X-Forwarded-For}i : Real client IP address

Example log lines from different browsers

192.168.3.13 - [21/Dec/2017:13:30:35 +0800] "GET /img/jlt1.png HTTP/1.1" 200 66045 "http://www.mytest.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299"
192.168.3.13 - [21/Dec/2017:13:33:56 +0800] "GET /img/Exhibition-bg.png HTTP/1.1" 200 5866 "http://www.mytest.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
192.168.3.13 - [21/Dec/2017:13:34:43 +0800] "GET /img/expert3.jpg HTTP/1.1" 200 8161 "http://www.mytest.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:57.0) Gecko/20100101 Firefox/57.0"
192.168.3.13 - [21/Dec/2017:13:32:35 +0800] "GET /img/cm2.png HTTP/1.1" 200 12341 "http://www.mytest.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"