.H3 "Log file format"
.Daemon httpd
logs accesses and errors to the files you specify.  It's worth understanding
what's inside them.  The following example shows five log entries.  Normally
each entry is all on a very long line.
.Dx
p50859b17.dip.t-dialin.net - -			\fIname of system, more\fP\|
[01/Nov/2002:07:06:12 +1030]			\fIdate of access\fP\|
"GET /Images/yaoipower.jpeg HTTP/1.1"		\fIHTML command\fP\|
200						\fIstatus (OK)\fP\|
19365						\fIlength of data transfer\fP\|
"http://www.deadjournal.com/users/firestormdragon/friends"  \fIreferral address\fP\|
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"  \fIbrowser type\fP\|

aceproxy3.acenet.net.au - - 
[01/Nov/2002:07:35:34 +1030] 
"GET /Images/randomgal.big.jpeg HTTP/1.0" 
304 -						\fIstatus (cached)\fP\|
"http://www.deadjournal.com/users/ice_orbs/friends" 
"Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"

218.24.24.27 - -				\fIsystem without reverse DNS\fP\|
[01/Nov/2002:07:39:55 +1030] 
"GET /scripts/root.exe?/c+dir HTTP/1.0"		\fIlooking for an invalid file\fP\|
404 284 "-" "-"					\fIstatus (not found)\fP\|

218.24.24.27 - - 
[01/Nov/2002:07:39:56 +1030] 
"GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 "-" "-"

218.24.24.27 - - 
[01/Nov/2002:07:39:56 +1030] 
"GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-"

218.24.24.27 - - 
[01/Nov/2002:07:40:00 +1030] 
"GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 
404 323 "-" "-"
218.24.24.27 - - 
.De
The fields in the log file are separated by blanks, so empty entries are
replaced by a \f(CW-\fP character.  In this example, the second and third
fields are always empty.  They're used for identity checks and authorization.

  The
default value will log everything if you want, but  The access log looks like this:
log.  Specify their names with the 



