Log Formats

The program automatically recognizes Combined and Common log formats of the Apache web server. We recommend you to use the Combined log format because the Common log format doesn't contain information about referrers and user agents (OS, browsers, spiders). By default Apache uses the Common log format but the majority of hosting providers set the Combined log format for Apache on their servers.

Here is a sample of log entry in Combined format:
213.135.131.79 - - [15/May/2002:19:21:49 -0400] "GET /features.htm HTTP/1.1" 200 9955 "https://www.weblogexpert.com/download.htm" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"

Log format can be configured by editing the "httpd.conf" file in the Apache conf directory (if you have access to this file). The configuration settings for the log file should look like the following:

# The following directive defines the "combined" nickname
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
 
# The location and format of the access log file
CustomLog logs/access.log combined

 
If your Apache log files contain information about multiple virtual domains (sites) hosted on the same server, you can also use the following configuration settings:

# The following directive defines the "combinedvhost" nickname
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %v" combinedvhost
 
# The location and format of the access log file
CustomLog logs/access.log combinedvhost

In this case log entries will have Combined format with one extra field (virtual domain). WebLog Expert needs this information if you use the "virtual domain" filter or need to create the "Virtual Domains" report.

 
If your Apache log files have custom format, it is also possible to specify it in the profile properties.

You can read more about Apache logs at http://httpd.apache.org/docs/logs.html

In addition to Apache logs, WebLog Expert supports log files of other web servers that use similar log formats, e.g. Nginx.

WebLog Expert supports the W3C Extended log format that is the default log format of IIS 4/5/6/7/8/10. By default IIS log files contain only few fields but you can configure IIS to show other fields:

IIS 4/5/6:
1. Open the "Properties" dialog for your web server.
2. On the "Web Site" property sheet choose "W3C Extended Log File Format" as the active log format.
3. Click the "Properties" button to open the "Extended Logging Properties" dialog.
4. Use the "Extended Properties" sheet to set the logged fields.

IIS 7/8/10:
1. Open your server or site in the IIS manager.
2. Double-click the "Logging" icon.
3. Choose "W3C" as the active log format.
4. Click the "Select Fields" button to open the "W3C Logging Fields" dialog and use it to set the logged fields.

The current version of WebLog Expert uses the following fields:

·Date (date)

·Time (time)

·Client IP Address (c-ip)

·User Name (cs-username)

·Server Name (s-computername)

·Server Port (s-port)

·Method (cs-method)

·URI Stem (cs-uri-stem)

·URI Query (cs-uri-query)

·Protocol Status (sc-status)

·Win32 Status (sc-win32-status)

·Bytes Sent (sc-bytes)

·Time Taken (time-taken)

·Host (cs-host)

·User Agent (cs(User-Agent))

·Referer (cs(Referer))

However, we recommend you to check all the available fields, not only the above ones, because the other fields may be used in the future versions of the program.

The program can also recognize the X-Forwarded-For field used with many proxy servers and load balancers to log original client IP. If this field exists, the program uses its value as client IP address instead of the value of the c-ip field.

In addition to IIS logs, WebLog Expert supports log files of other web servers that have the W3C Extended format, including Amazon CloudFront, Microsoft ISA/TMG, and Windows Azure.