Re: [cobalt-users] logs... how to read/understand

[flash22@xxxxxxx]

On Tue, 14 May 2002, Henrique (RaQ4) wrote:

> I'd like to know how to read and Understand logs like that:
Well, the apache docs do describe the log format, but, here's a quick view

> ---------------
> 61.175.178.234 - - [24/Mar/2002:11:54:54 -0600] "GET /chinese/ HTTP/1.1" 
> 302 220 
> "http://hk.yahoo.com/business_and_economy/companies/sex/Adult_Programs/"; 
> "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"

61.175.178.234 	The IP address of the machine that requested the page
- - 		where username would go if you had a password
[24/Mar/2002:11:54:54 -0600] date page requested, and timezone 
GET 		requested a page
/chinese/ 	the page requested, in this case , a directory
HTTP/1.1	The protocol, 1.1 implies virtual host support
302		The result of the request for the page, error/success/etc
		302 is a redirect, the server told the client to go
		somewhere else, probably to /chinese/index.html

220		The size of the document in characters/bytes
"http://hk.ya...   The page the user came from to get you you, eg the
		referrer page
Mozilla/4.0 ..	The identity claimed by the users web browser, 
		exactly what appears here is more or less up to the
		browser

> 210.52.26.158 - - [25/Mar/2002:08:42:56 -0600] "POST 
> http://10.140.1.212/KillSession.asp HTTP/1.0" 200 653 "-" "-"

same thing, but POST is logged from sending back a form, note that 
'size' (653) in this case is in the other direction

> Do you have some tutorial?

The apache website, the o'reily books....

keep in mind the logs show what the web server is doing, to understand
them, you have to understand what it does...sometimes in some detail...

Here's the status/error codes

http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

Nice condensed version is at
http://home.cern.ch/~offline/web/http_error_codes.html


gsh