Understanding Apache's access log

Question

What do each of the things in this line from my access log mean?

127.0.0.1 - - [05/Feb/2012:17:11:55 +0000] \"GET / HTTP/1.1\" 200 140 \"-\" \"Mozilla

Answer 1

You seem to be using the combined log format.

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined

• %h is the remote host (ie the client IP)
• %l is the identity of the user determined by identd (not usually used since not reliable)
• %u is the user name determined by HTTP authentication
• %t is the time the request was received.
• %r is the request line from the client. ("GET / HTTP/1.0")
• %>s is the status code sent from the server to the client (200, 404 etc.)
• %b is the size of the response to the client (in bytes)
• Referer is the Referer header of the HTTP request (containing the URL of the page from which this request was initiated) if any is present, and "-" otherwise.
• User-agent is the browser identification string.

The complete(?) list of formatters can be found here. The same section of the documentation also lists other common log formats; readers whose logs don't look quite like this one may find the pattern their Apache configuration is using listed there.