Access and Error Logs

[button url="rfc-configuration"][/button]

Redhat/Fedora/CentOS Configuration

The following default configuration directives are specified in the absence of specific virtual host container configuration for the Linux distributions listed.

Redhat/Fedora/CentOS

Table of Default Directives

* Conditioned on loaded log_config_module.

** Conditioned on loaded logio_module.

Virtual Host Config

Provide a <virtualhost></virtualhost> container within the main config /etc/httpd/conf/httpd.conf or a config file specified within the /etc/httpd/conf.d directory, such as vhost.conf, which is then read by default upon server start.

[button url="opensuse-configuration"][/button]

OpenSUSE Configuration

The following default configuration directives are specified in the absence of specific virtual host container configuration for the Linux distributions listed.

OpenSUSE

Table of Default Directives

* Conditioned on loaded log_config_module.

** Conditioned on loaded logio_module.

*** Conditioned on loaded mod_ssl.

Default Virtual Host Overrides

Virtual host config (port 80):

[quote]/etc/apache2/default-vhost.conf[/quote]

Virtual host config (port 443):

[quote]/etc/apache2/default-vhost-ssl.conf[/quote]

[button url="application-module"][/button]

Applicable Modules

The Apache web server offers a number of modules that either change the way Apache works or extend its capability.

mod_log_config:

This module is compiled in by default in the Apache base. Directives Include:

BufferedLogs: Buffers log entries in memory before writing to disk. This is an On|Off switch.

CustomLog: Sets the filename and log file format.

LogFormat: Specifies log file format.

TransferLog: Specifies the log file location.

mod_log_debug

Configurable debug logging. This module is experimental and may or may not be provided in a package distribution. If provided, it will likely require enabling. Directives include:

LogMessage: User-defined messages logged to an error log.

Example: adding configurable debug messages to a location tag similar to below.

[quote] LogMessage “/path/to/specific/directory has been requested by” ${REMOTE_ADDR} [/quote]

mod_log_forensic

Allows forensic request logging and analysis. Often included in package distributions but may require enabling. This module supercedes mod_unique_id for forensic purposes.

A “+” sign precedes the unique identifier for an initial request log entry.
A “-” sign indicates subsequent log entries for the same request.
A final log entry for a given request includes a “-” sign preceding the unique identifier. This indicates final forensic request log entry. Directives include:

ForensicLog: Used to log requests for forensic analysis. Each log entry is assigned a unique identifier.
Forensic Log Format: Specifies a unique forensic ID to the beginning of the log string. This is not a directive, but rather information related to the id itself and the significance of the initial id character, which indicates first and subsequent log writes.
ForensicLog: Specifies a filename for the forensic log location relative to the server root. This directive can be specified in the main server config, or within a vhost config.

Example: Initial forensic log entry calling https://localhost using default log format:

[quote]+3264:55958cb4:0|GET / HTTP/1.1|Host:localhost|Connection:keep-alive| Cache-Control:max-age=0| Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8| User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36| Accept-Encoding:gzip, deflate, sdch| Accept-Language:en-US,en;q=0.8| If-None-Match:"2cf6-519e8edfca429-gzip"| If-Modified-Since:Thu, 02 Jul 2015 18%3a51%3a39 GMT[/quote]

Example: Ending forensic log entry from the above request.

[quote]-3264:55958cb4:0[/quote]

Example: Standard port 80 vhost config for a site including a custom forensic log:

[quote] ServerName example.com ServerAdmin webmaster@example.com DocumentRoot /var/www/example.com LogLevel info ssl:warn ErrorLog /var/www/example.com/logs/error.log CustomLog /var/www/example.com/logs/access.log example CustomLog /var/www/example.com/logs/forensic.log forensic [/quote]

Usage notes:
If an ending log entry is not written, which means there is no “-<unique id>” entry, the request did not complete, indicating script failure.
Once module is enabled, adding a %{forensic-id} variable to a regular log format string will include a forensic identifier in other logs, i.e.:

[quote]LogFormat "%{forensic-id} %h %l %u %t "%r" %>s %O" common[/quote]

mod_logio:

Adds three new logging formats to the mod_log_config format specifications, including byte quantities received, sent, and transferred (combination of received and sent quantities). Normally included in the base Apache compile.
LogIOTrackTTFB: Enables time tracking between the initial request read time and the moment the first byte response is sent.

mod_filter: Provides context-sensitive filters to the output chain by registering any number of filter providers. mod_filter is not specific to logging, but allows for extracting specific requests based on the filter provider. Context containers include: main apache config, vhost config, within directory tags, and .htaccess files.

Employing this module allows for filtering requests containing such things as certain injection criteria and which IP address it’s from.

This module is provided by default in many of the package distributions, but may require enabling. For the purposes of logging, the FilterTrace directive posts information to the error log. Directives include:

AddOutputFilterByType: Assigns an output filter to a particular media type.
FilterChain: Configures a filter chain.
FilterDeclare: Declares a smart filter.
FilterProtocol: Causes the mod_filter to handle response headers correctly.
FilterProvider: Registers filter providers.
FilterTrace: Allows for debugging/diagnostic information to an error log prior to provider processing.

Example: Filtering in a vhost context container conditionally on filter and include modules:

[quote] #Declare a resource type filter: FilterDeclare xss #Register a provider: FilterProvider xss INCLUDES %{REQUEST_FILENAME}="(/[<>]+)$" #FilterProvider ... #Build the chain: FilterChain xss #Declare a custom log: CustomLog /var/www/log/xss.log xss #Format the log entry: LogFormat "%h %u %t "%r" %>s "%{Referer}i" "%{User-Agent}i"" xss [/quote]

mod_unique_id:

Constructs an environment variable and a unique identifier for each request. Often included in package distributions but may require enabling. This unique identifier is written to the access log.

This module has been superseded by mod_log_forensic for forensic purposes, but is still supported for others.

Unlike the forensic identifier, the unique identifier is passed to the application handler via the environment variable UNIQUE_ID. This allows application developers to trace a request through the web server to the application server. It can be useful for debugging a request.

Apache spins off child processes to handle requests, and a child instance processes several requests at a time. As a result, it is sometimes desirable to use a unique identifier to identify a single request across multiple server instances and child processes.

Once enabled, the module provides an identifier by default to the application handler.

Example:

[quote]UNIQUE_ID: Vaf3en8AAQEAAAtoQlAAAAAA[/quote]

The identifier is constructed from a 32-bit IP address, 32-bit process ID, 32-bit timestamp coupled to a 16-bit counter for tighter resolution than a single-second, 32-bit thread index. The timestamp component is UTC to prevent issues with daylight saving time adjustments. The application handler should treat the identifier as an opaque token only and not dissected into constituents.