LogsDB
Apache HTTP Server logo

Apache HTTP Server Access Log

Records every HTTP request processed by Apache

Edit this page

Quick Facts

Default Path (Linux)
/var/log/apache2/access.log
Docker
stdout
Default Format
combined
JSON Native
No
Rotation
logrotate

Log Example

Default format: Combined Log Format

Example Log Entrylog
192.168.1.50 - alice [20/Dec/2025:14:32:18 +0100] "GET /api/users HTTP/1.1" 200 1534 "https://app.example.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Structure:

%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"

Paths by Platform

Debian , Ubuntu
/var/log/apache2/access.log
RHEL / CentOS / Fedora
/var/log/httpd/access_log
Alpine
/var/log/apache2/access.log

Available Formats

Combined Log Format

Default

Example:

192.168.1.50 - alice [20/Dec/2025:14:32:18 +0100] "GET /api/users HTTP/1.1" 200 1534 "https://app.example.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Structure:

%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"

Common Log Format (CLF)

Example:

192.168.1.50 - alice [20/Dec/2025:14:32:18 +0100] "GET /api/users HTTP/1.1" 200 1534

Structure:

%h %l %u %t "%r" %>s %b

Virtual Host Combined

Example:

www.example.com:80 192.168.1.50 - alice [20/Dec/2025:14:32:18 +0100] "GET /api/users HTTP/1.1" 200 1534 "-" "Mozilla/5.0"

Structure:

%v:%p %h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"

Fields Reference

FieldTypeDescriptionExample
h%h
ip
Remote hostname or IP192.168.1.50
l%l
string
Remote logname (from identd)Note: Usually - (not available)-
u%u
string
Remote user (from auth)alice
t%t
datetime
Time the request was received[20/Dec/2025:14:32:18 +0100]
r%r
string
First line of requestGET /api/users HTTP/1.1
s%>s
integer
Final status code200
b%b
integer
Size of response in bytes (- if 0)1534
Referer%{Referer}i
string
Referer headerhttps://app.example.com
User-Agent%{User-Agent}i
string
User-Agent headerMozilla/5.0 (Windows NT 10.0; Win64; x64)

Parsing Patterns

Grok Patterns

combined:

%{COMBINEDAPACHELOG}

common:

%{COMMONAPACHELOG}

Regular Expressions

combined:

^(?P<host>\S+) (?P<ident>\S+) (?P<user>\S+) \[(?P<timestamp>[^\]]+)\] "(?P<request>[^"]*)" (?P<status>\d+) (?P<bytes>\S+) "(?P<referer>[^"]*)" "(?P<useragent>[^"]*)"

Collector Configurations

logstashruby
1filter {
2  grok {
3    match => { "message" => "%{COMBINEDAPACHELOG}" }
4  }
5}

Configuration

Enable Logging

Directive:

CustomLog /var/log/apache2/access.log combined

Disable Logging

Directive:

CustomLog /dev/null combined

Log Rotation

Tool: logrotate | Config: /etc/logrotate.d/apache2

/etc/logrotate.d/apache2
/var/log/apache2/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 640 root adm
    sharedscripts
    postrotate
        /usr/sbin/apachectl graceful > /dev/null
    endscript
}

Use Cases

Traffic monitoring

Request rate and response codes

s
t

Bandwidth analysis

Data transferred over time

b

Troubleshooting

Tested On

v2.4.58 on Ubuntu 24.04
admin - 2025-12-10
Last updated: 2025-12-15 by jean_ops
2 contributors156 upvotes
Validated

Community Discussions

Help improve this documentation

Found an error or want to add more examples? Contributions are welcome!

EditReport Issue