How to configure detailed Apache logging

Apache is a widely-used web server that logs essential information about client requests, server responses, and various events. These logs are crucial for monitoring server activity and diagnosing issues. However, the default logging settings might not provide enough detail when troubleshooting complex problems.

In such cases, increasing the verbosity of Apache's logs can offer more insight. By adjusting the LogLevel and LogFormat settings, you can capture more detailed information about each request and response. This includes headers, connection errors, and other critical data that might be necessary for resolving specific issues.

While detailed logging is helpful, it should be used cautiously. It can quickly consume disk space and impact server performance. Therefore, enable verbose logging only when needed and revert to normal logging levels once you have the required information.

1. Open the terminal on your server.
2. Search for LogLevel directive in Apache's configuration files.

   $ sudo grep -nr ^LogLevel /etc/{httpd,apache2}/
   grep: /etc/httpd/: No such file or directory
   /etc/apache2/apache2.conf:143:LogLevel warn

   Related: Location for Apache configuration

3. Open the Apache configuration file using your preferred text editor.

   $ sudo /etc/apache2/apache2.conf

4. Change the LogLevel value to a more verbose option.

   LogLevel debug

   Options range from emerg, alert, crit, error, warn, notice, info, to debug. The debug level logs the most information.

5. Save the file and exit the text editor.
6. Search for LogFormat directive in Apache's configuration files.

   $ sudo grep -nr ^LogFormat /etc/{httpd,apache2}/
   grep: /etc/httpd/: No such file or directory
   /etc/apache2/apache2.conf:212:LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
   /etc/apache2/apache2.conf:213:LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
   /etc/apache2/apache2.conf:214:LogFormat "%h %l %u %t \"%r\" %>s %O" common
   /etc/apache2/apache2.conf:215:LogFormat "%{Referer}i -> %U" referer
   /etc/apache2/apache2.conf:216:LogFormat "%{User-agent}i" agent
   </WRAP> 
   LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-agent}i"" combined
   CustomLog ${APACHE_LOG_DIR}/access.log combined

7. Open the Apache configuration file using your preferred text editor.

   $ sudo /etc/apache2/apache2.conf

8. Customize the LogFormat directives as required.

   Related: LogFormat string reference

   The word at the end of the LogFormat directives (common, combined, vhost_combined, etc.) are nicknames for the format strings. These nicknames can be used in the CustomLog directive for your VirtualHost to specify which format to use when logging.

   Standard Combined Format:

   LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined

   Explanation: This is the default combined log format. It logs the client’s IP address (%h), user identifier (%l), username (%u), request time (%t), the request line from the client (%r), status code (%>s), response size in bytes (%b), the referring URL (%{Referer}i), and the user-agent string (%{User-Agent}i). This format provides a comprehensive view of each request.

   Minimalist Log Format:

   LogFormat "%h %l %u %t "%r" %>s %b" minimal

   Explanation: This custom format logs only the essential details: the client’s IP, user identifier, username, request time, request line, status code, and response size. It's useful when you want a simplified log output with only key information.

   Verbose Format with Headers:

   LogFormat "%v %h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i" "%{Host}i" "%{Accept}i" "%{Accept-Language}i"" verbose

   Explanation: This custom format extends the standard combined format by including additional request headers like Host, Accept, and Accept-Language. It's useful for debugging issues related to content negotiation or server name routing.

   Log Format with Query String:

   LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i" "%q"" query_included

   Explanation: This format includes the query string of the request (%q). It’s particularly helpful for troubleshooting issues where the query string might be affecting the server’s response.

   Referer-Based Logging:

   LogFormat "%{Referer}i -> %U" referer

   Explanation: This format logs the referring URL and the requested resource (%U). It's useful for analyzing which external sites are linking to your resources.

   User-Agent and Time:

   LogFormat "%t "%{User-Agent}i"" user_agent_time

   Explanation: This format focuses on logging the request time and the user-agent string. It’s useful when you need to analyze traffic patterns based on user-agent or when diagnosing issues with specific browsers or devices.

9. Save the file and exit the text editor.
10. Restart Apache to apply the changes.

    $ sudo systemctl restart apache2 # Ubuntu, Debian
    $ sudo systemctl restart httpd # CentOS, Red Hat

    Related: How to manage the Apache web server service

11. Monitor the Apache logs to view the verbose output.

    $ tail -f /var/log/apache2/error.log # Ubuntu, Debian
    $ tail -f /var/log/httpd/error_log # CentOS, Red Hat