Apache Log Analysis

httpd.conf에서 CustomLog파일의 위치, 이름 설정

LogFormat "%h %l %u %t \"%r\" %>s %b" common

[...]

CustomLog logs/access_log common   

 

통합된 LogFormat은 Referer와 User-Agent가 포함 되도록 확장 설정

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\"

\"%{User-Agent}i\"" combined

[...]

CustomLog logs/access_log combined

 

HostnameLookups 옵션을 On이나 Off로 설정하여 DNSLookup을 실행한 로그 기록가능

(과부하 걸릴 수 있음)

 

 

HostnameLookup이 꺼진 경우의 로그

66.134.177.170 -- [20/Feb/2004:15;34:13 -0800]

"GET /index.html HTTP/1.1" 200 13952

 

HostnameLookup이 켜진 경우의 로그

h-66-134-177-170.sttnwaho.covad.net - -

[20/Feb/2004:15:37:50 -0800]

"GET /index.html HTTP/1.1" 20013952

 

combines 형식 사용 시

h-66.134-177-170.sttnwaho.covad.net - -

[20/Feb/2004:15:46:03 -0800]

"GET /index.html HTTP/1.1" 200 13952

http://www.craic.com/index.html

"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6)

Gecko/204027 Firefox/0.8"

 

○ User_Agent

 

Linux, Firefox Version 0.8

"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6)

Gecko/20040207 Firefox/0.8"

 

PowerPC Macintosh Mac OS X, Safari

"Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.5.6

(KHTML, like Gecko) Safari/125.12"

 

Windows 2000, Microsoft Internet Explorer 6.0

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;

ESB{837E7A43-A894-47CD-8B49-6C273A84BE29}; SV1)"

 

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;

{A0D0A528-5BFC-4FB3-B56C-EC45BCECC088}; SV1; .NET CLR)"

 

{A0D0A528-5BFC-4FB3-B56C-EC45BCECC088} - 시리얼 번호?(확실치는 않음)

 

MSN, Yahoo, Goolge BOT

- msnbot/1.0 (+http://search,msn,com/msnbot.htm)

- Mozilla/5.0 (compatible; Yahoo! Slurp;

http://help.yahoo.com/help/us/ysearch/slurp)

- Googlebot/2.1 (+http://www.gle.com/bot.html)