Page Comparison

%a

Remote IP-address

{geoip:Client Remote IP,ftype=remoteip;type=;,}

%A

Local IP-address

%B

%A

Local IP-address

{ip:Local IP,ftype=localip}

%B

Size of response in bytes, excluding HTTP headers.

{number:BytesSentBytes Sent,ftype=bytesent}

%b

Size of response in bytes, excluding HTTP headers. In CLF format, i.e. a '-' rather than a 0 when no bytes are sent.

{textnumber:BytesSentBytes Sent,ftype=bytesent}

%{Foobar}C

The contents of cookie Foobar in the request sent to the server. Only version 0 cookies are fully supported.

{string:Cookie_< FOOBAR >}

Replace < FOOBAR > with cookie name

%D

The time taken to serve the request, in microseconds.

{number:ResponseTimeMilliSecsResponseTimeMicroSecs,ftype=processrequestmilliprocessrequestmicrosecs}

%{FOOBAR}e

The contents of the environment variable FOOBAR

{string:EnvVariable_< FOOBAR >}

Replace < FOOBAR > with variable name

%f

Filename

{text:FileName}

%h

Remote host name (or IP address if resolveHosts is false)

{text:Remotehost,ftype=remoteip}

%H

The request protocol

{text:RequestProtocol,ftype=reqprotocol}

%{Foobar}i

The contents of Foobar: header line(s) in the request sent to the server. Changes made by other modules (e.g. mod_headers)

affect this. If you're interested in what the request header was prior to when most modules would have modified it, use mod_setenvif to copy the header into an

internal environment variable and log that value with the %{VARNAME}e described above.

{text:<FOOBAR>}

https://en.wikipedia.org/wiki/List_of_HTTP_header_fields and so on it goes for the different headers.

%{Referer}i

{string:RefererQuery,ftype=refererquery;,}{regexp:Referer,ftype=referer;refName=RefererQuery,^([\w-]+://[^?]+|/[^?]+)}

%{User-

Agent}i

{

text:User

-agent,ftype=useragent

}

{iptext:X-Forwarded-For,ftype=forwardforip}

%k

Number of keepalive requests handled on this connection. Interesting if KeepAlive is being used, so that, for example, a '1'

means the first keepalive request after the initial one, '2' the second, etc...; otherwise this is always 0 (indicating the initial request).

Available in versions 2.2.11 and later.

{number:KeepAlive}

%l

Remote logname (from identd, if supplied). This will return a dash unless mod_ident is present and IdentityCheck is set On.

{stringtext:logname,ftype=remotelog;,}

%m

The request method

{choice:Method,ftype=reqmethod;,GET;POST;HEAD}

%{Foobar}n

The contents of note Foobar from another module.

{string:<FOOBAR>}

%{Foobar}o

The contents of Foobar: header line(s) in the reply.

{string:<FOOBAR>}

%p

The canonical port of the server serving the request

{number:ServerPort,ftype=serverport}

%{format}p

The canonical port of the server serving the request or the server's actual port or the client's actual port. Valid formats are canonical, local, or remote.

%{canonical}p

%{local}p

%{remote}p

{number:ServerPort,ftype=serverport}

{number:LocalServerPort,ftype=localserverport}

{number:RemotePort,ftype=remoteport}

serverport

localserverportt

remoteport

%P

The process ID of the child that serviced the request.

{text:ProcessID,ftype=processid}

%{format}P

The process ID or thread id of the child that serviced the request. Valid formats are pid, tid, and hextid. hextid requires APR 1.2.0 or higher.

{text:ProcessID,ftype=processid}

Valid formats are pid, tid, and hextid. 

%q

The query string (prepended with a ? if a query string exists, otherwise an empty string)

{stringtext:QueryQueryString,ftype=querystring;,}

OR

Suggest a regexp that will build a list of parameters as columnscloumns.

The query string (prepended with a ? if a query string exists, otherwise an empty string)

%r

First line of request

1. {choice:Method,ftype=reqmethod;,GET;POST}

1. {

1. url:URL,paramsFtype=querystring;ftype=requrl

1. ;paramsName=Query;,} {string:reqprotocol,ftype=reqprotocol;,}

reqmethod

requrl

querystring

reqprotocol

%R

The handler generating the response (if any).

{text:ResponseHandler}

%s

Status. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

{number:ResponseStatus,ftype=respstatus}

. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

{text:UserSessionID,ftype=sessionid}

%t

Time the request was received (standard english format)

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

The time

{number:ResponseTimeSecs,ftype=processrequestsecs}

%{UNIT}T

The time taken to serve the request, in a time unit given by UNIT. Valid units are ms for milliseconds, us for microseconds, and s for seconds. Using s gives the

same result as %T without any format; using us gives the same result as %D. Combining %T with a unit is available in 2.2.30 and later.

1. {number:ResponseTimeMilliSecs,ftype=processrequestmilli}
2. {number:ResponseTimeMicroSecs,ftype=processrequestmicrosecs}
3. {number:ResponseTimeSecs,ftype=processrequestsecs}

processrequestmilli

processrequestmicrosecs

processrequestsecs

The time, in the form given by format, which should be in an extended strftime(3) format (potentially localized). If the format starts with begin: (default)

the time is taken at the beginning of the request processing. If it starts with end: it is the time when the log entry gets written, close to the end of the request

processing. In addition to the formats supported by strftime(3), the following format tokens are supported:

sec

sec

number of seconds since the Epoch

msec

number of milliseconds since the Epoch

usec

number of microseconds since the Epoch

msec_frac

millisecond fraction

usec_frac

microsecond fraction