Apache HTTP Server access log — Forensic Artifact Reference (Network)

01Location

Which client address requested which URL, with which method and status, and how large was the response?
Which referring page and which user agent did the client present (Combined format)?
When did the server receive the request, and in which UTC offset is that time written?

Format	Plain text, one line per request, shaped by a LogFormat string. Common Log Format is "%h %l %u %t \"%r\" %>s %b"; the Combined format adds "%{Referer}i" and "%{User-agent}i".
Applies to	Directives as in the current Apache HTTP Server manual for mod_log_config. Other web servers use different logging modules and defaults.

Field	What it tells you
%h	Remote host. It is the IP address unless HostnameLookups is on, and modules such as mod_remoteip can change it.
%l	Remote logname from identd; a dash unless mod_ident is present and IdentityCheck is on.
%u	Remote user if the request was authenticated. It may be bogus when the status is 401.
%t	Time the request was received, for example [18/Sep/2011:19:18:28 -0400]. The last number is the offset from GMT.
%r	The first line of the request.
%>s	The final status. Plain %s is the status of the original request when the request was redirected internally.
%b	Size of the response in bytes, excluding HTTP headers; a dash in CLF when no bytes were sent.
%{Referer}i, %{User-agent}i	Values of the named request headers. They are supplied by the client and can be set to anything.

Field	Encoding	Note
%t	Text date with numeric UTC offset, e.g. 18/Sep/2011:19:18:28 -0400	By default the time is taken at the beginning of request processing. A format of %{end:...}t gives the time the entry is written instead, so read the LogFormat before comparing with other logs.
%{sec}t, %{msec}t, %{usec}t	Unix seconds, milliseconds or microseconds	Epoch tokens that avoid the offset ambiguity; present only if the format uses them.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

Collect every CustomLog and LogFormat line, plus the virtual-host layout, to know which file records which site and in which format.
Convert each time to UTC using the offset written on the line, not the offset of your own workstation.
If a proxy or load balancer sits in front, find out whether %h shows the proxy or the original client, and whether the original address is logged elsewhere.
Treat Referer and User-agent as claims by the client, and use them to group requests rather than to identify a person.
Corroborate with the application log, the error log (the %L log ID links the two) and any proxy or firewall log.

The log shows requests the server received, not what the person behind the client did next. A 200 status means the server answered; it does not show that the response was read.
The format is chosen by the administrator. Fields such as Referer, duration or the end-of-request time may simply not be recorded.
%b excludes HTTP headers, so it is not the number of bytes on the wire.
With internal redirects, %s and %>s differ, and %r may show the original rather than the final request.