For computer
log management, the Common Log Format, also known as the NCSA Common log format, (after
NCSA HTTPd
NCSA HTTPd is a discontinued web server originally developed at the NCSA at the University of Illinois at Urbana–Champaign by Robert McCool and others. First released in 1993, it was among the earliest web servers developed, following Tim Bern ...
) is a standardized
text file
A text file (sometimes spelled textfile; an old alternative name is flat file) is a kind of computer file that is structured as a sequence of lines of electronic text. A text file exists stored as data within a computer file system.
In ope ...
format used by
web server
A web server is computer software and underlying Computer hardware, hardware that accepts requests via Hypertext Transfer Protocol, HTTP (the network protocol created to distribute web content) or its secure variant HTTPS. A user agent, co ...
s when generating
server log files. Because the format is standardized, the files can be readily analyzed by a variety of
web analysis programs, for example
Webalizer and
Analog.
Each line in a file stored in the Common Log Format has the following syntax:
host ident authuser timestamp request-line status bytes
The format is extended by the Combined Log Format with
referer and
user-agent
In computing, the User-Agent header is an HTTP header intended to identify the user agent responsible for making a given HTTP request. Whereas the character sequence User-Agent comprises the name of the header itself, the header value that a giv ...
fields.
Example
127.0.0.1 ident alice
1/May/2025:07:20:10 +0000"GET /index.html HTTP/1.1" 200 9481
A field set to dash () indicates missing data.
* is the IP address of the client (remote host) which made the request to the server.
* is the
RFC 1413 identity of the client, if supplied.
* is the userid of the person requesting the document. Missing unless
HTTP authentication is used.
* is the request timestamp. Here in
strftime format .
* is the request line from the client. The method , the resource requested, and the
HTTP protocol version.
* is the
HTTP status code returned to the client.
* is the response size, in
bytes
The byte is a unit of digital information that most commonly consists of eight bits. Historically, the byte was the number of bits used to encode a single character of text in a computer and for this reason it is the smallest addressable un ...
.
Usage
Log files are a standard tool for computer systems developers and administrators. They record the "what happened, when, by whom" of the system. This information can record faults and help their diagnosis. It can identify security breaches and other computer misuse. It can be used for auditing. It can be used for accounting purposes.
The information stored is only available for later analysis if it is stored in a form that can be analysed. This data can be structured in many ways for analysis. For example, storing it in a relational database would force the data into a query-able format. However, it would also make it more difficult to retrieve if the computer crashed, and logging would not be available unless the database was available. A plain text format minimises dependencies on other system processes, and assists logging at all phases of computer operation, including start-up and shut-down, where such processes might be unavailable.
See also
*
Extended Log Format
*
Log management and intelligence
Log management is the process for generating, transmitting, storing, accessing, and disposing of log data. A log data (or ''logs'') is composed of entries (records), and each entry contains information related to a specific event that occur within ...
*
Web log analysis software Web log analysis software (also called a web log analyzer) is a kind of web analytics software that parses a server log file from a web server, and based on the values contained in the log file, derives indicators about when, how, and by whom a web ...
*
Web counter
*
Data logging
A data logger (also datalogger or data recorder) is an electronic device that records data over time or about location either with a built-in instrument or sensor or via external instruments and sensors. Increasingly, but not entirely, they a ...
*
Syslog
In computing, syslog () is a standard for message logging. It allows separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. Each message is labeled with a facility code, ...
References
{{Reflist
Log file formats