Raw Data Logs
Below is an example of the information collected based on a standard request for a World Wide Web document:
[30/Oct/2003:17:30:24 -0500] 0 200 769 GET www.nrl.navy.mil 220.127.116.11 "/images/web9.gif" "http://www.nrl.navy.mil/" "Mozilla/4.77 [en] (X11; U; Linux 2.4.20-8 i686)" "GET /images/web9.gif HTTP/1.1" -
[30/Oct/2003:17:30:24 -0500] - is the timestamp and timezone on the server at the time of the request.
0 200 769 - 0 is the execution time in seconds, 200 is the status "OK- the request was filled", 769 is the number of bytes sent.
GET www.nrl.navy.mil - is the request method and server name processing the request.
18.104.22.168 - is the IP address of requesting host.
/images/web9.gif - is the web page object being requested, in this case an image.
http://www.nrl.navy.mil/ - is the referring page of this request.
Mozilla/4.77 [en] (X11; U; Linux 2.4.20-8 i686) - identifies the type of browser used to access the page. This information can be used to choose which design parameters to use in constructing the page.
GET /images/web9.gif HTTP/1.1 - is the first line of the actual request sent by the browser.
the final '-' is the clients username if they've completed HTTP authentication, otherwise '-'.