A Guide to Apache Access and Error Logs

Apache HTTP Server remains one of the most widely used web servers today, powering over 30% of all websites globally, according to W3Techs. Given its popularity, understanding Apache’s logging system is crucial for optimizing server performance, troubleshooting issues, and maintaining security.

Apache maintains two main types of logs:

1. Access Logs – Track incoming HTTP requests.
2. Error Logs – Record server-side errors and operational issues.

This guide explores the structure, configuration, and best practices for managing both types of logs.

Log & Configuration File Locations

Before diving into the specifics of Apache logs, it’s helpful to know where Apache stores its logs and configuration files:

Description	Location
Log Files	/var/log/apache2/
Configuration File	/etc/apache2/apache2.conf
Virtual Hosts	/etc/apache2/sites-available/

---

Understanding Apache Access Logs

What Are Access Logs?

Apache access logs record all incoming HTTP requests to your server. They provide crucial insights into:

• Visitor behavior (e.g., pages viewed, resources requested)
• Client information (e.g., IP addresses, user agents)
• Traffic sources and referrer URLs

Access logs are essential for traffic analysis, security monitoring, and performance optimization.

Configuring Access Logs

Apache uses the CustomLog directive in its configuration files to define where access logs are stored. By default, access logs are written to /var/log/apache2/access.log:

CustomLog /var/log/apache2/access.log combined

Customizing the Access Log Format

Apache’s default log format (combined) captures the following information:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

This format records:

• Client IP address
• User ID (if authenticated)
• Timestamp of the request
• HTTP request line (method, path, and protocol)
• Response status code
• Size of the response in bytes
• Referrer URL
• User agent string

You can customize the log format to include additional information, such as X-Forwarded-For headers for requests behind a proxy:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-Forwarded-For}i\"" custom
CustomLog /var/log/apache2/access.log custom

Sample Access Log Entry

A typical access log entry might look like this:

192.168.1.1 - - [15/Oct/2024:10:24:05 +0000] "GET /index.html HTTP/1.1" 200 4523 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Here’s a breakdown of the components:

Field	Example	Description
%h	192.168.1.1	Client IP address
%l	–	RFC 1413 identity (not often used)
%u	–	Authenticated user (if any)
%t	[15/Oct/2024:10:24:05 +0000]	Timestamp of the request
%r	GET /index.html HTTP/1.1	HTTP method, path, and protocol
%>s	200	HTTP response status code
%b	4523	Size of the response in bytes
%{Referer}i	–	Referrer URL
%{User-Agent}i	Mozilla/5.0 …	Client’s user agent

---

Understanding Apache Error Logs

What Are Error Logs?

Apache error logs capture server errors, warnings, and operational issues. This log is invaluable for diagnosing configuration problems, server crashes, and application errors.

Configuring Error Logs

The ErrorLog directive in the Apache configuration file determines where error logs are stored:

ErrorLog /var/log/apache2/error.log

Error Log Levels

Apache supports 7 levels of error severity, which can be set using the LogLevel directive:

Level	Description
emerg	System is unstable
alert	Immediate action required
crit	Critical conditions needing immediate attention
error	General errors
warn	Warning conditions
notice	Normal but significant information
info	Informational messages
debug	Detailed debugging messages

To set a specific log level:

LogLevel warn

Sample Error Log Entry

An example of an Apache error log entry:

[Wed Nov 15 11:12:30.123456 2024] [php7:error] [pid 1234] [client 192.168.1.1:56789] PHP Fatal error: Uncaught Exception: Division by zero in /var/www/html/index.php on line 42

This entry shows a PHP fatal error caused by an unhandled exception.

Common Error Types

Some typical Apache error log messages include:

Error	Description
client denied by server config	Access blocked by server configuration
File does not exist	Requested file not found on the server
PHP Fatal error	Uncaught exceptions or fatal errors in PHP scripts
SSL Library Error	Issues during SSL/TLS handshake

---

Configuring Logs by Virtual Host

If you are hosting multiple domains on a single Apache server, it’s helpful to separate logs for each domain. This is done in the VirtualHost configuration:

<VirtualHost *:80>
    ServerName domain1.com
    DocumentRoot /var/www/domain1
    ErrorLog /var/log/apache2/domain1.error.log
    CustomLog /var/log/apache2/domain1.access.log combined
</VirtualHost>

<VirtualHost *:80>
    ServerName domain2.com
    DocumentRoot /var/www/domain2
    ErrorLog /var/log/apache2/domain2.error.log
    CustomLog /var/log/apache2/domain2.access.log combined
</VirtualHost>

In this example:

• domain1.com and domain2.com have their own dedicated access and error logs.
• Log formats can be customized for each domain independently.

---

Mastering Apache logs is key to maintaining server performance, diagnosing issues, and ensuring the security of your web applications. By leveraging access logs and error logs effectively, you can gain valuable insights into your server’s operation and visitor behavior.

Use this guide to optimize your Apache logging configuration and improve your server management capabilities.