httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Scott Haneda <>
Subject [users@httpd] is this a valid apache log format, if not, what can I do to fix it?
Date Thu, 14 Feb 2008 04:31:17 GMT
httpd -v
Server version: Apache/1.3.33 (Darwin)
Server built:   Jan 30 2006 03:08:20
 From my httpd.conf:
LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-
Agent}i\"" virtual

Snip of a few log lines: - - [22/Jan/2008:08:14:19 -0800] "GET /
\" + gaJsHost + \" HTTP/1.1" 400 376 "-" "-" - - [22/Jan/2008:08:15:56 -0800] "GET /
os-x-finder-tutorial-and-customizations-part-5/\" + gaJsHost +
\" HTTP/1.1" 400 376 "-" "-" - - [23/Jan/2008:14:12:51 -0800]
"GET /experiment-modify-customize/\" + gaJsHost + \"google- HTTP/1.1" 400 376 "-" "-"

These show up as errors in my stats software, (
The developer stated the following:
Something strange is going on. Spaces are flat out illegal in
requests, yet that request has spaces in it, in addition to the double
quotes. Apache is inconsistant in it's logging of requests with
invalid characters in them. It is possible to work around the double
quote problem, but it is impossible to work around the spaces without
adding a log fixing process with some other tool between Apache and

I do not mind working out a parsing routing to clean the bad lines up,
if they are indeed bad.  Ideally, I would like to find out where the
issue is, and prevent this from happening, as it is now, my stats are
devalued as a result of the lines.

I really do not want to have to send my logs to a separate parser just
to keep them clean.  The apache docs on what the tokens stand for are
clear, what I can not find out is a clear definition of how the logs
format should be.  If space is a delimiter, I can understand how the
above examples are indeed going to be hard to parse out correctly.

Thanks in advance.


The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:> for more info.
To unsubscribe, e-mail:
   "   from the digest:
For additional commands, e-mail:

View raw message