Web log field mappings


There are three fields in the access.log I’m unsure of, can anyone assist? Below is what I see in the logs:

remoteip - - [date/time] “method uri http_protocol” status responseSize? “referrer” “useragent”

It’s the two dashes after remoteip and responsesize I’m looking for help on. The responsesize is my guess so I’m looking for confirmation. the dashes I think may be clientip and serverip?


The format we’re using for the access log is Common Log Format, a standard web server log format used across many systems.

The second field is the RFC 1413 IDENT of the remote user. This protocol is no longer in use on the modern Internet, and is not configured to be used at all on our servers, so this field will always be empty (represented as a dash).

The third field represents the active username if the user has authenticated themseves to the server using a HTTP username and password. This only really comes into play if you have set up password-protected directories, WebDAV, or SVN under your domain; in all other cases, it is blank (again, represented as a dash).