IIS uses different formats to create log files. The most common two are NCSA and W3C standard. This format is identical to the Apache Common log format. You can treat such a log file similar to how you would treat an apache log file. The field definitions of the W3C logging format are shown below. The path plus basename of the logfile. If logfile includes any '%' characters, it is treated as a format string for strftime (3). Otherwise, the suffix.nnnnnnnnnn is automatically added and is the time in seconds (unless the -t option is used). Both formats compute the start time from the. Httpd probably runs as user apache or user httpd. Your log is owned and only writable by root. Change ownership of your log file to make this work. This should do the trick.

• Httpd Log File Location
• How To Open Log Files

Web server logs all traffic to a log file. There are various formats and this page will help you understand the log formats that are used. The most popular logging formats are the NCSA (Common or Combined) used mostly by Apache and the W3C standard used by IIS. These formats will be explain in more detail below.

APACHE LOG FILES

One of the many pieces of the Website puzzle is Web logs. Traffic analysis is central to most Websites, and the key to getting the most out of your traffic analysis revolves around how you configure your Web logs. Apache is one of the most, if not the most powerful open source solutions for Website operations. You will find that Apache’s Web logging features are flexible for the single Website or for managing numerous domains requiring Web log analysis. For the single site, Apache is pretty much configured for logging in the default install. The initial httpd.conf file (found in /etc/httpd/conf/httpd.conf in most cases) should have a section on logs that looks similar to this (Apache 2.0.x), with descriptive comments for each item. Your default logs folder will be found in /etc/httpd/logs . This location can be changed when dealing with multiple Websites, as we’ll see later. For now, let’s review this section of log configuration.

Error Logs

The error log contains messages sent from Apache for errors encountered during the course of operation. This log is very useful for troubleshooting Apache issues on the server side. Apache Log Tip: If you are monitoring errors or testing your server, you can use the command line to interactively watch log entries. Open a shell session and type “tail ?f /path/to/error_log” . This will show you the last few entries in the file and also continue to show new entries as they occur. There are no real customization options available, other than telling Apache where to establish the file, and what level of error logging you seek to capture. First, let’s look at the error log configuration code from httpd.conf.

You may wish to store all error-related information in one error log. If so, the above is fine, even for multiple domains. However, you can specify an error log file for each individual domain you have. This is done in the container with an entry like this:

If you are responsible for reviewing error log files as a server administrator, it is recommended that you maintain a single error log. If you’re hosting for clients, and they are responsible for monitoring the error logs, it’s more convenient to specify individual error logs they can access at their own convenience.

Apache’s definitions for their error log levels are as follows:

Tracking Website Activity – Access Logs

Often by default, Apache will generate a log file called access. This tracks the accesses to your Website, the browsers being used to access the site and referring urls that your site visitors have arrived from. It is commonplace now to utilize Apache’s “combined” log format, which compiles all three of these logs into one logfile. This is very convenient when using traffic analysis software as a majority of these third-party programs are easiest to configure and schedule when only dealing with one log file per domain. Let’s break down the code in the combined log format and see what it all means.

LogFormat starts the line and simply tells Apache you are defining a log file type (or nickname), in this case, combined. Now let’s look at the cryptic symbols that make up this log file definition.

To review all of the available configuration codes for generating a custom log, see Apache’s docs on the module_log_config , which powers log files in Apache.
Apache Log Tip: You could capture more from the HTTP header if you so desired. A full listing and definition of data in the header is found at the World Wide Web Consortium. http Logs Viewer supports a number of log formats and directives and these can be found here.
For a single Website, the default entry would suffice:

However, for logging multiple sites, you have a few options. The most common is to identify individual log files for each domain. This is seen in the example below, again using the log directive within the container for each domain.

In the above example, we have three domains with three unique Web logs (using the combined format we defined earlier). A traffic analysis package could then be scheduled to process these logs and generate reports for each domain independently.

IIS LOG FILES

IIS uses different formats to create log files. The most common two are NCSA and W3C standard.

NCSA

This format is identical to the Apache Common log format. You can treat such a log file similar to how you would treat an apache log file.

W3C

The field definitions of the W3C logging format are shown below. Some Fields start with a prefix which explain which host (client/server/proxy) the field refers to.

Httpd Log File Location

How To Open Log Files

A sample W3C log file is shown below: