Mastering Tomcat and Apache Log Formats: Patterns, Parameters, and Browser Differences

Tomcat Log Explanation

Configuration file server.xml

Default log pattern

pattern="%h %l %u %t \"%r\" %s %b"

Recommended pattern

pattern="%{X-FORWARDED-FOR}i %l %u %t %r %s %b %D %{User-Agent}i"

Sample log output

192.168.3.14 - - [14/Dec/2017:17:56:05 +0800] GET /solr/admin/cores?... HTTP/1.1 200 487 3

Parameter details

%a : remote IP address
%A : local IP address
%b : bytes sent, excluding HTTP headers, or "-" if none
%B : bytes sent, excluding HTTP headers
%D : time taken to process request (ms)
%h : remote host name
%H : request protocol
%I : current request thread name
%l : remote logical username from identd (always "-")
%m : request method
%p : local port
%q : query string (prefixed with "?" if present)
%r : first line of request
%s : HTTP response status code
%S : user session ID
%t : date and time in common log format
%T : time to process request (seconds)
%u : remote user authentication
%U : URL path requested
%v : local server name

httpd Log Explanation

Recommended format

LogFormat "%{X-Forwarded-For}i %l %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

Parameter details

%a : remote IP address
%A : local IP address
%B : bytes sent, excluding HTTP headers
%b : CLF format bytes sent, "-" if none
%{FOOBAR}e : contents of environment variable FOOBAR
%f : filename
%h : remote host
%H : request protocol
%{Foobar}i : contents of request header Foobar
%l : remote login name (from identd)
%m : request method
%{Foobar}n : contents of note "Foobar" from another module
%{Foobar}o : contents of response header Foobar
%p : server port used for response
%P : child process ID handling request
%q : query string (including "?" if present)
%r : first line of request
%s : status code of original request; %>s for final status after internal redirects
%t : time in common log format
%{format}t : time in specified format
%T : time taken to serve request (seconds)
%u : remote user (may be forged if status %s is 401)
%U : URL path requested
%v : server name
%V : canonical server name per UseCanonicalName
%{Referer}i : referring page URL
%{User-agent}i : user agent string
%{X-Forwarded-For}i : real client IP address

Browser differences in logs

Edge

192.168.3.13 - [21/Dec/2017:13:30:35 +0800] "GET /img/jlt1.png HTTP/1.1" 200 66045 "http://www.mytest.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299"
...

IE

192.168.3.13 - [21/Dec/2017:13:33:56 +0800] "GET /img/Exhibition-bg.png HTTP/1.1" 200 5866 "http://www.mytest.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
...

Firefox

192.168.3.13 - [21/Dec/2017:13:34:43 +0800] "GET /img/expert3.jpg HTTP/1.1" 200 8161 "http://www.mytest.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:57.0) Gecko/20100101 Firefox/57.0"
...

Chrome

192.168.3.13 - [21/Dec/2017:13:32:35 +0800] "GET /img/cm2.png HTTP/1.1" 200 12341 "http://www.mytest.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
...