Combined Log Format

The Combined Log Format is a standardized log format used by a number of web servers to keep track of accesses to websites. It is one of the formats available in Apache., and is similar to the Common Log Format except for the addition of two more fields, the referer and user agent.

The format is defined by this expression in the httpd.conf (Apache) file:

"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""

This consists of the following space-separated fields:


 * Hostname or IP address of accesser of site. If a proxy server is between the end-user and the server, that might get logged here instead of the actual accesser's address.


 * RFC 1413 identity of client; this is noted by Apache as unreliable, and is usually blank (represented by a hyphen (-) in the file).


 * Username of user accessing document; will be a hyphen (-) for public web sites that have no user access controls.


 * Timestamp string surrounded by square brackets, e.g. [12/Dec/2012:12:12:12 -0500]


 * HTTP request surrounded by double quotes, e.g., "GET /stuff.html HTTP/1.1"


 * HTTP status code: 200 for successful access, 404 for not-found, and other codes.


 * Number of bytes transferred in requested object


 * Referer: URL where user came from to get to your site, if sent by client to server (surrounded by double quotes)


 * User agent string sent by client (surrounded by double quotes). Can be used to identify what browser was used, but can be misleading.